Cookie policy
Last updated: 13 August 2026
The short version: FirmProof sets strictly necessary cookies only — the ones that sign you in and keep the free scan fair. We set no advertising cookies, no tracking cookies, and our analytics ( Plausible) is cookieless and doesn't collect personal data. Payments happen on Stripe's own website, not ours.
The cookies we set
| Cookie | What it does | Lasts | Type |
|---|---|---|---|
| fp_at | Keeps you signed in during a visit (your session's access token). HttpOnly — not readable by page scripts. | Up to 1 hour | Strictly necessary · first party |
| fp_rt | Keeps you signed in between visits (refresh token). HttpOnly. | 30 days | Strictly necessary · first party |
| fp_pkce | Completes a secure sign-in with Google or Microsoft (the OAuth PKCE handshake). HttpOnly. | 10 minutes | Strictly necessary · first party |
| fp_sid | Applies the fair-use limit on the free scan (one a day per person). A random identifier — our server stores only a salted one-way hash of it, so it cannot be linked back to you. | 12 months | Strictly necessary (abuse prevention) · first party |
| Cloudflare Turnstile | Bot protection on the free-scan page only. Cloudflare's challenge widget may use its own cookies or local storage from challenges.cloudflare.com to tell humans from bots. | Set by Cloudflare | Strictly necessary (security) · third party |
Why there's no accept/reject banner
UK law (PECR regulation 6) requires consent for cookies unless they are strictly necessary for a service you have asked for. Every cookie in the table above falls under that exemption — signing you in, completing a sign-in you initiated, and keeping the free scan fair and bot-free. Because there is nothing optional to consent to, a consent banner would be theatre; the ICO's guidance is that strictly necessary cookies need transparency (this page), not a consent wall. If we ever introduce a non-essential cookie, we will add a genuine accept/reject mechanism first.
What we deliberately don't use
No advertising or marketing cookies. No cross-site tracking or profiling. No social media pixels. Our visitor analytics is Plausible — an EU-hosted, cookieless service that counts page views without collecting personal data or using any persistent identifier. That is also why clearing your cookies won't change what analytics we see: there is nothing about you in it.
Managing cookies
You can delete or block cookies in your browser settings at any time. Because everything we set is functional, blocking cookies for firmproof.co.uk will stop sign-in from working and may stop the free scan; the marketing and guide pages will work fine without any cookies at all.
Questions
More detail on how we handle personal data is in the Privacy Notice. Anything else: support@firmproof.co.uk.