Cookie policy.

Short version

We use two kinds of cookies, both strictly necessary: a session cookie (so you stay signed in) and a CSRF protection cookie (so forms can’t be hijacked). Both are first-party. Neither tracks you across sites.

We do not use any third-party advertising cookies, cross-site trackers, Facebook Pixel, Google Analytics, or any other behavioural advertising mechanism.

Because we only use strictly necessary cookies, we do not show a cookie banner. The UK PECR rules permit strictly necessary cookies without consent.

What a cookie is

A cookie is a small text file a website stores in your browser. Cookies have two useful jobs: remembering who you are between page loads (so you don’t have to sign in twice), and protecting forms from cross-site attacks. Cookies also have one widely abused job: tracking people across multiple sites for advertising. We don’t do that one.

What we use

The complete list of cookies set by freewebsiteaudit.ai:

session

First-party. Set when you sign in. Keeps you signed in between pages and between visits within its lifetime. Lifetime: 30 days. Lawful basis: strictly necessary (UK PECR Regulation 6(4)).

csrf

First-party. Used to protect forms (audit submission, payment, account changes) from cross-site request forgery attacks. Lifetime: session. Lawful basis: strictly necessary (UK PECR Regulation 6(4)).

Both cookies are SameSite=Lax, Secure, and HttpOnly where applicable. The session cookie is signed and rotated on privilege escalation events.

What we deliberately do not use

• Google Analytics (we self-host Plausible, which is cookieless)
• Facebook Pixel, Meta Pixel, TikTok Pixel, X Pixel
• Google Ads / Microsoft Ads conversion tracking cookies
• Behavioural retargeting cookies (Criteo, AdRoll, similar)
• Heatmap or session-replay tools that fingerprint visitors
• Cross-site identity graphs

If we add any of the above in future, this policy is updated first, a banner appears, and your prior consent is requested before any non-necessary cookie is set.

Your controls

You can clear our cookies at any time from your browser’s privacy settings. If you do, you will be signed out and will need to sign in again to use account features.

Modern browsers offer fine-grained cookie controls (allow per-site, block third-party only, clear on close). We design the site to work with all of these.

Changes to this policy

If we ever change what cookies we use, this page is updated and the change is noted in the changelog at the bottom of the privacy policy. Material changes that add non-strictly-necessary cookies will be accompanied by a consent banner before the cookies are set.