Cookie Policy
Most cookie policies are long because the site has a lot to disclose. Ours is short: two cookies, both required to keep you signed in, and neither one set until you do.
At a glance
Two cookies, both essential
Both exist to keep you signed in. Nothing here exists to watch you.
None until you sign in
Browse the site and run any tool logged out, and we set no cookies at all.
You stay in control
Block them in your browser. The tool pages keep working; sign-in will not.
What cookies are
A cookie is a small text file a site stores in your browser and reads back on your next request. It is how a website remembers that you are signed in, or that you chose dark mode.
Cookies are not inherently a tracking technology — they become one when a site sets them to follow you across other websites. We do not do that.
What we set
Both are strictly necessary, and both are issued only when you sign in. Until then, this site sets no cookies whatsoever.
| Cookie | Duration | Purpose |
|---|---|---|
access_token | 15 minutes | Authorises each request while you are signed in |
refresh_token | 30 days | Renews the short-lived token so you are not signed out every 15 minutes |
Both are first-party, set only by pocketutils.com, and marked HttpOnly and SameSite=Strict — so no script can read them and no other site can send them. Neither contains personal data; both hold a signed token and nothing else.
Your light or dark theme preference is kept in your browser's localStorage, not in a cookie. It never leaves your device and is never sent to us with a request.
What we don't set
- Advertising or marketing cookies
- Third-party tracking cookies
- Social media pixels
- Cross-site or cross-device tracking
- Behavioural profiling
- Retargeting or remarketing
This is why the notice in the corner of the page is a notice and not a consent gate. Under the ePrivacy rules, strictly necessary cookies do not require consent — and we set nothing else, so there is nothing here for you to accept or refuse.
Analytics
We use SiteBehaviour to understand traffic volume, rough geographic region, and device type. It reports in aggregate.
- It does not set cookies. Which is why nothing from analytics appears in the table above.
- No personal information is collected.
- No profile is built, and nothing follows you to other sites.
- It answers questions like “are the docs getting read?” — not “what did this person do?”
Details of what is processed and on what basis are in the Privacy Policy.
Third parties
Two services set their own cookies, and only when you actually reach them:
- The payment processor — during checkout and billing management only, for fraud prevention and to complete the payment.
- Cloudflare Turnstile — the bot check on the tool pages and contact form. It confirms you are human without the puzzle grids, and without profiling you.
Both operate under their own policies for the cookies they set.
Managing cookies
In your browser
- Chrome — Settings → Privacy and security → Third-party cookies
- Firefox — Settings → Privacy & Security → Cookies and Site Data
- Safari — Settings → Privacy → Manage Website Data
- Edge — Settings → Cookies and site permissions → Cookies and site data
What breaks if you block them
| Feature | Without cookies |
|---|---|
| Tool pages and playgrounds | Work normally |
| Reading the docs | Works normally |
| The contact form | Works normally |
| Light / dark preference | Works — it is not a cookie |
| Signing in | Fails: you are signed out on every request |
| The account dashboard and API keys | Unreachable |
Questions about any of this go to support@pocketutils.com.
Something here unclear?
Plain-English answers beat legal text. Write to us and a human replies.