Cookie Policy

Browsing this website while signed out sets no cookies at all. We checked, in a clean browser profile, and that is why there is no consent banner in your way.

Signing in sets one cookie so that you stay signed in. Two others exist for specific jobs you have to ask for. That is the whole list, and it is below.

There are no advertising cookies, no cross-site tracking, no third-party tags, no pixels and no data brokers. The accessibility widget we sell sets no cookie either — not on our site and not on yours.

A cookie is a small file a website asks your browser to keep and send back on later requests. It is how a site can tell that the request it is answering now is from the same browser as the one that signed in a minute ago.

A session cookie is discarded when you close the browser; a persistent one has an expiry date and survives until then. A first-party cookie is set by the site you are on; a third-party one is set by somebody else’s code embedded in it. Every cookie in the table below is first-party and persistent.

HttpOnly means scripts running in the page cannot read the cookie — only the server receives it. All three of ours are HttpOnly.

The session cookie holds your email address, signed so it cannot be edited in a browser, and nothing else. It is not an identifier we look up in an advertising profile, because there is no such profile.

The third row is named for one specific scan, so the name you would find in your own browser ends with that scan’s id rather than the placeholder shown here.

We do measure how the product is used. We do it without cookies and without storing an identifier for you, which is the part worth being specific about:

Our host also keeps request logs, which include your IP address, for security and debugging. That is a server-side log rather than something stored on your device, and the privacy notice covers it.

If you install the LatchKey widget, it does not set a cookie on your visitors. What it stores is their own preferences — larger text, higher contrast, a reading profile — in localStorage, under a single key, scoped to your origin. Nothing about those choices is sent to us, and clearing site data or using a private window resets them.

The endpoint that receives the widget’s telemetry is forbidden from setting a cookie on any response it can produce, including its error responses, and there is a test asserting the header is absent. That rule exists for your benefit rather than ours: a cookie set from there would be attributed to your site by every consent tool that looks.

What that means for your consent banner. Because the widget sets no cookie and its beacon carries no identifier, no IP address and no page content, there is in our reading nothing here that requires consent under the ePrivacy rules — a preference stored in the visitor’s own browser to deliver a setting they just chose is the kind of storage those rules exempt. That is our reading of our own software, not legal advice about your jurisdiction. The facts you need in order to take your own view are in the privacy notice, including the full list of events the widget may send.

You do not need our permission and there is no preference centre to visit: every browser can block or delete cookies for a site, usually under Privacy or Site settings, and doing it for this site is entirely your call.

The consequence is straightforward rather than punitive. Blocking our cookies means you cannot sign in — the portal has no other way to tell that a request is yours. The marketing pages, the documentation and the free page scanner all work with cookies blocked. Unlocking a free scan’s PDF does not.

Signing out deletes the session cookie immediately. Deleting your account removes the server-side records the privacy notice describes.

We do not track you across websites, so a DNT or Sec-GPC header has nothing to switch off here. Rather than claim to honour a signal we do not act on, the honest statement is that our behaviour is the same either way, and it is already the behaviour those signals are asking for.

The widget does respect the signals that are about how a page behaves rather than about tracking: prefers-reduced-motion and the rest of the accessibility preferences your browser exposes.

The date at the top is when this document last changed. Because the table above is generated from the same list the application reads when it sets a cookie, a new cookie cannot appear in the product without appearing here. Questions go to privacy@thelatchkey.in.