Cookie Policy

This page lists, by name, every cookie and every browser storage item that sporesec.com, the client portal (app.sporesec.com) and the admin site (admin.sporesec.com) keep on your device. Each item shows what it is for, how long it is kept, who sets it and what lets it run.

How we handle personal data in general is in the Privacy Policy.

The cookie banner offers three things: Keep essential, Accept all and Settings. Essentials and the basic visit count are always on, so they have no switch. Settings lets you choose Functional, Analytics, Session recordings and Advertising one by one, and Manage Cookies in the footer opens it at any time.

In the countries the Privacy Policy lists, and when we cannot tell where you browse from, these four settings start off. Elsewhere, Analytics and Functional are on by default under the banner's notice. Session recordings and Advertising always require a choice. With Global Privacy Control or Do Not Track on, Analytics, Session recordings and Advertising start off and can be enabled in Settings. While either signal is on, we do not send the separate pre-submit form draft to our server.

These run for everyone, in every country. Without them a page, a sign-in or something you asked for would not work.

• sporesec_consent (Local storage, sporesec.com, set by us): Your cookie choice, the banner it answered and when, so we do not ask on every page. Kept: until you clear your browser data. Runs because the site needs it.
• sporesec_consent_dismissed (Session storage, sporesec.com, set by us): You closed the cookie banner without choosing, so it stays closed in this tab. Kept: until you close the tab. Runs because the site needs it.
• sporesec_chunk_reload (Session storage, sporesec.com, the portal, the admin site, set by us): Stops a page that failed to load after an update from reloading itself in a loop. Kept: until you close the tab. Runs because the site needs it.
• sporesec_book_preview (Cookie, sporesec.com, set by us): A private test link for our own booking form. Visitors never receive it. Kept: 2 hours. Runs because the site needs it.
• sporesec_pending_claim (Cookie, the portal, set by us): Carries a saved scan to your new account while you confirm your email. Kept: one day. Runs because the site needs it.
• sporesec_pending_proposal (Cookie, the portal, set by us): Carries a saved package to your new account while you confirm your email. Kept: one day. Runs because the site needs it.
• sporesec_google_signup_pass (Cookie, the portal, set by us): Proves you accepted the terms while you sign up with Google. Kept: 10 minutes. Runs because the site needs it.
• __Host-sporesec.session_data (Cookie, the portal, set by us): A short signed copy of your session, so the portal does not ask the database on every page. Kept: 5 minutes. Runs because the site needs it.
• __Host-sporesec.dont_remember (Cookie, the portal, set by us): Marks that you did not tick “stay signed in”, so your sign-in ends with the browser. Kept: until you close the browser. Runs because the site needs it.
• __Host-sporesec.two_factor (Cookie, the portal, the admin site, set by us): Holds your place between your password and your second sign-in step. Kept: 10 minutes. Runs because the site needs it.
• __Host-sporesec.state (Cookie, the portal, set by us): Protects a sign-in with Google against forged requests. Kept: 5 minutes. Runs because the site needs it.
• sporesec-portal-google-attempt (Session storage, the portal, set by us): Notes that you pressed Sign in with Google, so we know the round trip was yours. Kept: until you close the tab. Runs because the site needs it.
• spore-notice-seen:<notice> (Session storage, the portal, the admin site, set by us): Keeps a portal notice you already read folded in this tab. Kept: until you close the tab. Runs because the site needs it.
• __cf_bm (Cookie, sporesec.com, the portal, the admin site, set by a provider that works for us): Set by Cloudflare only when its bot protection checks a visit. Kept: 30 minutes. Runs because the site needs it.
• cf_clearance (Cookie, sporesec.com, the portal, the admin site, set by a provider that works for us): Set by Cloudflare only after a security challenge, so it is not shown again. Kept: as the provider sets it. Runs because the site needs it.
• NEXT_LOCALE (Cookie, sporesec.com, the portal, the admin site, set by us): Your language. Until you pick one it ends with the browser; a language you pick is kept for a year. Kept: until you close the browser, or 365 days if you chose that. Runs because you asked for it.
• portal-locale (Cookie, the portal, the admin site, set by us): The language you picked in the portal. Kept: 365 days. Runs because you asked for it.
• portal-sidebar-side (Cookie, the portal, the admin site, set by us): The side of the screen you picked for the sidebar. Kept: 365 days. Runs because you asked for it.
• portal-sidebar-rail (Cookie, the portal, the admin site, set by us): Whether you folded the sidebar. Kept: 365 days. Runs because you asked for it.
• portal-nav-prefs (Cookie, the portal, the admin site, set by us): The menu items you pinned or folded. Kept: 365 days. Runs because you asked for it.
• portal-table-density (Cookie, the admin site, set by us): The row height you picked for tables. Kept: 365 days. Runs because you asked for it.
• sporesec_pending_ref (Cookie, the portal, set by us): Carries a referral code to your new account, so the referral counts when you sign in. Set when you sign up from a referral link. Kept: 30 days. Runs because you asked for it.
• __Host-sporesec.session_token (Cookie, the portal, the admin site, set by us): Keeps you signed in. It ends with the browser, unless you tick “Keep me signed in on this device for 30 days”. Kept: until you close the browser, or 30 days if you chose that. Runs because you asked for it.
• __Host-sporesec.trust_device (Cookie, the portal, set by us): Skips the second sign-in step on this device. Set only if you tick “Remember this device for 30 days”. Kept: 30 days. Runs because you asked for it.
• sporesec-a11y-v2 (Local storage, sporesec.com, the portal, the admin site, set by us): The accessibility options you set. Kept: until you clear your browser data. Runs because you asked for it.
• sporesec-a11y-v2-touched (Local storage, sporesec.com, the portal, the admin site, set by us): Which accessibility options you changed yourself, so your device settings do not override them. Kept: until you clear your browser data. Runs because you asked for it.
• sporesec_offers (Local storage, sporesec.com, set by us): Your choice not to see offers. Kept: until you clear your browser data. Runs because you asked for it.
• sporesec_promo_quiet_until (Local storage, sporesec.com, set by us): One timestamp: the end of a 7-day pause after you close an offer. Kept: 7 days. Runs because you asked for it.
• sporesec-portal-returning (Local storage, the portal, the admin site, set by us): The email and sign-in method you used, if you ticked “Keep me signed in”. Removed when you sign in once with the box unticked. Kept: until you clear your browser data. Runs because you asked for it.
• sporesec.msgdraft.<thread> (Local storage, the portal, the admin site, set by us): A message you started in the portal and did not send yet. Kept: until you send it or clear your browser data. Runs because you asked for it.
• sporesec-scan-report (Session storage, sporesec.com, set by us): The result of the scan you ran, so a reload does not lose it. Kept: until you close the tab. Runs because you asked for it.
• sporesec-scan-start (Session storage, sporesec.com, set by us): The address you asked to scan from the home page, used once. Kept: until you close the tab. Runs because you asked for it.
• sporesec-booking-email (Session storage, sporesec.com, set by us): The email you typed, carried to the booking form when you press its link. Kept: until you close the tab. Runs because you asked for it.
• sporesec-booking-held (Session storage, sporesec.com, the portal, set by us): The call time held for you and the details you typed, so a page that reloads opens where you were. Removed once you book, send a request or change the time. Kept: until you close the tab. Runs because you asked for it.
• sporesec-configurator-build-<service> (Session storage, sporesec.com, set by us): The package you are building, for this tab, until you make a cookie choice that keeps it on the device. Kept: until you close the tab. Runs because you asked for it.
• sporesec-builder-hub (Session storage, sporesec.com, set by us): Your answers on the help-me-choose steps, for this tab, until you make a cookie choice that keeps them on the device. Kept: until you close the tab. Runs because you asked for it.
• sp-search-recent (Session storage, sporesec.com, the portal, the admin site, set by us): The results you opened from search, for this tab. Kept: until you close the tab. Runs because you asked for it.
• spore-notices-collapsed (Session storage, the portal, the admin site, set by us): You folded the portal notices in this tab. Kept: until you close the tab. Runs because you asked for it.
• spore-breach-nudge (Session storage, the portal, set by us): You closed the password warning in this tab. Kept: until you close the tab. Runs because you asked for it.

These remember what you started, so it is not lost. When you decline Functional, they leave this device.

• sporesec-configurator-build-<service> (Local storage, sporesec.com, set by us): The package you are building, so you can come back to it. Removed when you send it. Kept: until you send it or clear your browser data. Runs under the notice; where we ask first, only after you accept.
• sporesec-builder-hub (Local storage, sporesec.com, set by us): Your answers on the help-me-choose steps. Removed when you send your package. Kept: until you send it or clear your browser data. Runs under the notice; where we ask first, only after you accept.
• sporesec-pending-ref (Local storage, sporesec.com, set by us): The code of a referral link you opened, so the referral counts when you open an account. Kept: 30 days. Runs under the notice; where we ask first, only after you accept.
• sporesec_promo_seen (Session storage, sporesec.com, set by us): Which offers you already saw in this visit. Kept: until you close the tab. Runs only after you accept.
• sporesec_draft_<form> (Session storage, sporesec.com, set by us): The id of a saved form draft, so a reload continues the same draft. Kept: until you close the tab. Runs only after you accept.

These show us how people use the site. Declining Analytics stops analytics collection. The separate basic visit count still adds to daily totals by public page, country and referring site. Those totals contain no visitor identifier, and the count stores nothing on your device.

• sporesec_sid (Session storage, sporesec.com, set by us): A random visit id for this tab. It is not a cookie and it ends with the tab. Kept: until you close the tab. Runs under the notice; where we ask first, only after you accept.
• sporesec_promo_click (Session storage, sporesec.com, set by us): Which offer you clicked, to count whether it led to a request. Kept: until you close the tab. Runs under the notice; where we ask first, only after you accept.
• ph_<project>_<item> (Session storage, sporesec.com, set by a provider that works for us): PostHog, our analytics provider: its state for this visit, for this tab. Kept: until you close the tab. Runs under the notice; where we ask first, only after you accept.
• __ph_opt_in_out_<project> (Local storage, sporesec.com, set by a provider that works for us): PostHog: one flag that says analytics is on for this browser. It holds no id. Kept: until you clear your browser data. Runs under the notice; where we ask first, only after you accept.

Session recordings use the Analytics items listed above. Recording runs only while Analytics is on and you have accepted Session recordings.

No advertising pixel is active today. These appear only if you turn on Advertising and we run a campaign.

• _fbp (Cookie, sporesec.com, set by the provider for its own use): Meta pixel, not active today: measures ad campaigns, only if you turn on Advertising and we run one. Kept: 90 days. Runs only after you accept.
• fr (Cookie, sporesec.com, set by the provider for its own use): Meta pixel, not active today: set by Meta on its own domain, only if you turn on Advertising and we run a campaign. Kept: as the provider sets it. Runs only after you accept.

The bot check on our forms is Cloudflare Turnstile. It runs in a Cloudflare frame and reads what it needs to tell people from bots, under Cloudflare's Turnstile Privacy Addendum. The client portal registers a small service worker so it can be installed and can show the push notifications you turn on.

Your browser's own settings can remove or block everything on this page. Some features then stop working, and the cookie banner asks again.