Cookie policy
Version 1.0. Last updated 9 November 2026.
1. The three categories
- Strictly necessary storage is always on. It signs you in, remembers your choices, runs Paddle checkout and protects the site from abuse.
- Analytics: our own visit counting is optional and uses no cookies. We count page views and work out a rough daily visitor number. Your IP address is used for a moment to find your country and make that count, then thrown away. It is never stored. Separately, our hosting provider, Lovable, sets a 30-minute
session-idcookie on every visit for its own visitor statistics; your choice in our banner does not control it (see the list below). - Marketing is off, and there are no marketing tags on the site. If we ever add one (for example LinkedIn’s), it will load only if you turn Marketing on.
2. How visit counting works
When a page loads we send the page address (without anything after the ?), the site that linked you, any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content), your screen width rounded to phone, tablet or desktop, and your browser language. Our server adds your country from its network edge.
If you allow Analytics, the server also makes a one-way fingerprint from your IP address, browser and our domain, mixed with a random value that changes every day and is then deleted. We can tell that two page views on the same day came from the same visitor, but we can’t work out who you are, and we can’t link today to tomorrow.
If you choose Reject all, haven’t chosen yet, or your browser sends Do Not Track or Global Privacy Control, the page view is counted without a fingerprint and nothing is kept in your browser. Bots and our own staff are not counted. Raw visit rows are kept for 13 months and then reduced to daily totals.
3. Everything we use
Audited on the live site on 4 November 2026. Consent policy version 2026-11-05.
Cookies
__cf_bm
Tells people from bots so the site stays up and free checks aren't abused.
- Provider
- Cloudflare
- Category
- Strictly necessary
- Duration
- 30 minutes
- When
- Every visitor
__dpl
Keeps your visit on one consistent version of the site while a new version is published.
- Provider
- Lovable (our hosting provider)
- Category
- Strictly necessary
- Duration
- 24 hours, renewed on each visit
- When
- Every visitor
session-id
Counts visits for our hosting provider's visitor statistics. It is set by a script the host adds to every page, and visit events go to the host's analytics service (Tinybird).
- Provider
- Lovable (our hosting provider)
- Category
- Analytics
- Duration
- 30 minutes
- When
- Every visitor (set by the host)
Paddle checkout cookies
Runs the checkout, tax and fraud checks when you buy a plan. Set on Paddle's own domains.
- Provider
- Paddle (paddle.com)
- Category
- Strictly necessary
- Duration
- Set by Paddle; see Paddle's cookie policy
- When
- Only when you open checkout
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Tells people from bots so the site stays up and free checks aren't abused. (every visitor) | Strictly necessary | 30 minutes |
| __dpl | Lovable (our hosting provider) | Keeps your visit on one consistent version of the site while a new version is published. (every visitor) | Strictly necessary | 24 hours, renewed on each visit |
| session-id | Lovable (our hosting provider) | Counts visits for our hosting provider's visitor statistics. It is set by a script the host adds to every page, and visit events go to the host's analytics service (Tinybird). (every visitor (set by the host)) | Analytics | 30 minutes |
| Paddle checkout cookies | Paddle (paddle.com) | Runs the checkout, tax and fraud checks when you buy a plan. Set on Paddle's own domains. (only when you open checkout) | Strictly necessary | Set by Paddle; see Paddle's cookie policy |
Local storage
sp.consent
Remembers your cookie choice, the policy version you answered and a random consent ID (not linked to you or your account).
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you change it or the policy changes
- When
- After you choose
sp-theme
Remembers the colour theme you picked.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you clear it
- When
- Only if you change the theme
sb-lwatvylxpsfpeutvyvwv-auth-token
Keeps you signed in.
- Provider
- ScriptPreflight (Supabase sign-in)
- Category
- Strictly necessary
- Duration
- Until you sign out
- When
- Signed-in users
sp.selected_workspace
Remembers which workspace you were using.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you clear it
- When
- Signed-in users
sp.layout
Remembers the workbench panel layout.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you clear it
- When
- Signed-in users
sp.editor
Remembers editor settings such as font size.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you clear it
- When
- Signed-in users
sp-reports-view
Remembers how you like the reports list shown.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you clear it
- When
- Signed-in users
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| sp.consent | ScriptPreflight | Remembers your cookie choice, the policy version you answered and a random consent ID (not linked to you or your account). (after you choose) | Strictly necessary | Until you change it or the policy changes |
| sp-theme | ScriptPreflight | Remembers the colour theme you picked. (only if you change the theme) | Strictly necessary | Until you clear it |
| sb-lwatvylxpsfpeutvyvwv-auth-token | ScriptPreflight (Supabase sign-in) | Keeps you signed in. (signed-in users) | Strictly necessary | Until you sign out |
| sp.selected_workspace | ScriptPreflight | Remembers which workspace you were using. (signed-in users) | Strictly necessary | Until you clear it |
| sp.layout | ScriptPreflight | Remembers the workbench panel layout. (signed-in users) | Strictly necessary | Until you clear it |
| sp.editor | ScriptPreflight | Remembers editor settings such as font size. (signed-in users) | Strictly necessary | Until you clear it |
| sp-reports-view | ScriptPreflight | Remembers how you like the reports list shown. (signed-in users) | Strictly necessary | Until you clear it |
Session storage
tsr-scroll-restoration-v1_3
Puts you back at the same scroll position when you go back a page.
- Provider
- ScriptPreflight (TanStack Router)
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- Every visitor
sp.next
Returns you to the page you were on after signing in.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- While signing in
sp.invite_token
Holds a team invitation while you sign in to accept it.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- Accepting an invitation
sp.dismissed_invites
Hides invitations you dismissed in this tab.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- Signed-in users
sp.draft
Keeps the script you are editing in this tab, so a reload or a fresh sign-in doesn't lose it.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- Signed-in users
sp.context
Keeps the preflight options you chose with that draft.
- Provider
- ScriptPreflight
- Category
- Strictly necessary
- Duration
- Until you close the tab
- When
- Signed-in users
sp.visit
Remembers which campaign link (utm_ tags) brought you here, so a signup in this visit can be credited to it. No identifier.
- Provider
- ScriptPreflight
- Category
- Analytics
- Duration
- Until you close the tab
- When
- Only if you allow Analytics
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| tsr-scroll-restoration-v1_3 | ScriptPreflight (TanStack Router) | Puts you back at the same scroll position when you go back a page. (every visitor) | Strictly necessary | Until you close the tab |
| sp.next | ScriptPreflight | Returns you to the page you were on after signing in. (while signing in) | Strictly necessary | Until you close the tab |
| sp.invite_token | ScriptPreflight | Holds a team invitation while you sign in to accept it. (accepting an invitation) | Strictly necessary | Until you close the tab |
| sp.dismissed_invites | ScriptPreflight | Hides invitations you dismissed in this tab. (signed-in users) | Strictly necessary | Until you close the tab |
| sp.draft | ScriptPreflight | Keeps the script you are editing in this tab, so a reload or a fresh sign-in doesn't lose it. (signed-in users) | Strictly necessary | Until you close the tab |
| sp.context | ScriptPreflight | Keeps the preflight options you chose with that draft. (signed-in users) | Strictly necessary | Until you close the tab |
| sp.visit | ScriptPreflight | Remembers which campaign link (utm_ tags) brought you here, so a signup in this visit can be credited to it. No identifier. (only if you allow analytics) | Analytics | Until you close the tab |
The free check and the waitlist are protected by Cloudflare Turnstile, which runs a challenge from challenges.cloudflare.com and sets no cookies on our site.
4. Your choice and how we record it
Nothing optional is switched on until you choose. Accept all and Reject all are equal choices, and Manage preferences lets you choose per category. Change your mind at any time with “Cookie settings” at the foot of every page, or with the button at the top of this page.
We record your choice anonymously: a random consent ID, your choice per category, the policy version and the time. We don’t record your IP address or browser details with it. If this policy changes version, we ask again.
5. Your rights
Under South Africa’s Protection of Personal Information Act (POPIA) and, where it applies, the EU and UK GDPR, you can ask what we hold about you, have it corrected or deleted, object to or restrict how we use it, and withdraw consent at any time. Withdrawing consent doesn’t affect what happened before. Email privacy@scriptpreflight.com, and see our privacy notice for everything else, including how to complain to the Information Regulator (South Africa) or your local data protection authority.
6. Changes
If we change this policy or add a category, we’ll ask for your choice again.