Cookies notice

Cookies are small files a website saves in your browser. Similar technologies include local storage and tracking pixels. The law (the UK Privacy and Electronic Communications Regulations and the EU ePrivacy Directive) says websites must tell you about them, and ask for consent unless they're strictly necessary for a service you've asked for.

All of these are strictly necessary, so they're set without asking. You can block them in your browser, but then signing in and getting back to your scans won't work.

• agora_anon_scans (AgoraScan, agorascan.ai): remembers the ids of up to 10 free scans you ran without an account, so you can return to them and move them into your account if you sign up. Contains only signed scan ids. Lasts 30 days.
• agorascan:tasks:<report id> (AgoraScan, local storage in your browser): remembers which issues you added to a full audit's task list, so they're still ticked when you come back. Only set when you use the Task list button. Never sent to us; stays until you clear your browser's site data.
• agora_consent (AgoraScan, agorascan.ai): remembers your cookie choices, so we don't ask on every page. Contains only your choices and the date. Lasts 6 months, then we ask again.
• __session (Clerk, agorascan.ai): keeps you signed in and proves who you are to our servers. Short-lived and renewed while you're signed in.
• __client_uat (Clerk, agorascan.ai): records when you last signed in or out, so the site knows whether to check your session. Lasts [up to 1 year].
• __client (Clerk, [clerk.agorascan.ai]): your secure sign-in token on our sign-in provider's domain. Lasts [up to 1 year] or until you sign out.
• [Other Clerk cookies, such as __refresh or __clerk_db_jwt, if present on the production instance: confirm names and lifetimes in the browser before launch.]
• __cf_bm (Cloudflare, on Clerk's domain, if set): tells people and bots apart to protect sign-in. Lasts 30 minutes.

Payments happen on Stripe's secure checkout page. Stripe sets its own cookies there to prevent fraud and remember your payment session, under Stripe's cookie policy (stripe.com/cookies-policy). [If Stripe.js is loaded on agorascan.ai, add __stripe_mid (1 year) and __stripe_sid (30 minutes), used for fraud prevention.]

We count visits with Vercel Web Analytics. It doesn't set cookies or store anything on your device. Each visit is grouped using a code made from request details, which changes every day and can't be used to recognise you across days or other websites. We see only totals such as page views, referring sites, countries, browsers and device types, and Vercel only processes this for us.

This is on by default, because it's only used to improve the site (in the UK, the statistical-purposes exception in the Privacy and Electronic Communications Regulations). You can turn it off, free, at any time: open "Cookie settings" at the bottom of any page and switch off "Visitor statistics".

If you choose "Accept all" or turn on "Analytics" in Cookie settings, we load Google Analytics to see how people find and use AgoraScan, such as which pages they visit and where they came from. It sets the cookies _ga (2 years) and _ga_<id> (2 years). Google provides it as our processor. We've switched off its advertising features, so it isn't used to show you adverts, and we remove private report links and email addresses before anything is sent.

If you choose "Reject all", or your browser sends a Global Privacy Control signal, Google Analytics doesn't load at all.

"Cookie settings" at the bottom of every page (and in your dashboard) shows each type of cookie with a switch. Essential cookies are always on. Everything else is off until you agree, apart from cookieless visitor statistics, which you can turn off.

If your browser sends a Global Privacy Control signal, we treat it as "no" to advertising and tell you we've done so.

We keep a record of each choice (the choice, the version of this notice and the date, with nothing that identifies you), so we can show how consent was given.

• No advertising cookies or pixels (such as Google Ads, Meta or LinkedIn).
• No session recording.
• No affiliate tracking cookies on agorascan.ai. If you click a partner link in a report, the partner's site may set its own cookies to record that you came from us. That happens on their site, under their cookie policy.
• No tracking pixels in our emails.

If we ever add advertising cookies or pixels, we'll list them here and ask for your consent before any of them load, with "Reject all" right next to "Accept all".

If you see an AgoraScan score badge or website scanner on someone else's site, it loads from our servers but doesn't set cookies. The scanner sends what you type (your email and web address) to us to run the check for that site's owner.

You can delete or block cookies in your browser settings. Help is available from your browser's support pages. Blocking our necessary cookies will stop sign-in from working.

Questions? Email hello@agorascan.ai. More about how we use personal data is in our privacy notice.