Cookies
Last updated 29 September 2026.
1. What signing in sets
1.1
| Cookie | When | What it is for | How long |
|---|---|---|---|
sb-…-auth-token | When you sign in | Keeps you signed in. It is sometimes split into numbered parts (.0, .1) because of its size. | Up to 400 days, or until you sign out |
sb-…-auth-token-code-verifier and two others ending -code-verifier | When you ask for a sign-in code | Checks that the code is used in the browser that asked for it | Up to 400 days, or until you sign out |
paraph_org | When you switch organisation, or accept an invitation to one | Remembers which organisation you were working in | 365 days |
1.2
The part of each name shown as “…” is the identifier of our database project. Signing out removes all of them.
2. The bot check on the sign-in page
2.1
The sign-in page loads Cloudflare Turnstile, which checks that a person rather than a script is asking for a code. It runs only on that page. Cloudflare says it processes your IP address, your browser’s user agent and a fingerprint of the connection, only to tell people from bots. When we tested it, it set no cookies in the browser. Cloudflare is listed on the sub-processors page.
3. What we don’t use
3.1
No analytics, advertising or tracking cookies. This website counts page views with Vercel Web Analytics, which sets no cookies. The contact and feedback forms set no cookies either. The privacy page says what we hold and why.