Cookie Policy
Last updated: 23 October 2026
Clode sets eight cookies of its own, all needed for the site to work, and Google may set three more when you use its sign-in or our forms. Anything beyond that, such as noting which site sent you here, happens only if you allow it.
This is a plain-language document written to match how the product actually works. It is not legal advice.
1. Your choices
The law lets a site store or read information on your device without asking only when that is strictly necessary for a service you asked for; anything else needs your consent. Our cookie banner asks for it: Accept all, Reject all, or Choose what to allow. Until you answer, only necessary cookies are used, and rejecting limits nothing you can do here.
- Necessary, always on: signing in, security, your language and your cookie choice itself (section 2).
- Analytics, off until you allow it: we note which site sent you here, as described below.
Which site sent you here. We note it only if you allow analytics. A script on our pages reads that site's domain (such as google.com) from your browser, or takes the ?ref= or utm_source tag from the link you followed. The value then travels in this site's own links as ?via= while you move from page to page. It is not put in a cookie or in browser storage, but page addresses that carry it stay in your browser history like any other address. If you create an account, we keep it with the account (see the Privacy Policy); if you do not, we keep it only as part of the page addresses in our server logs.
Google Consent Mode. We use Google Consent Mode v2 in its basic form: no Google Analytics or Google Ads tag loads until you allow its category. Every public page starts with analytics_storage, ad_storage, ad_user_data and ad_personalization denied and passes on your choice once you make it. ad_personalization stays denied whatever you choose: we do not let Google use visits here to personalise ads or build remarketing audiences. Neither tag is set up on this site today.
Your answer is kept in the sct_consent cookie for 180 days; then the banner asks again, as it does as soon as we add a category or a Google tag. A new account also records it, with its time and the version of the banner you answered, to show what you agreed to. To change it, use Cookie settings at the bottom of our public pages, or the switches above. A change applies at once: withdrawing analytics stops the note of where you came from.
2. Necessary cookies
Set by Clode itself, on this site only. All are HttpOnly, so page scripts cannot read them, except sct_lang.
| Cookie | Purpose | Lifetime |
|---|---|---|
sct_sess | Keeps you signed in. | 30 days, or until you sign out |
_csrf | Set on your first visit. Pairs with a hidden token in each form, so another site cannot send a form in your name. | Until you close your browser |
sct_lang | Remembers the language you picked. | 1 year |
sct_consent | Remembers your answer to the cookie banner and when you gave it. | 180 days |
sct_2fa | Links your password to the two-factor code that follows it. | Up to 10 minutes |
oauth2-redirect-stateoauth2-code-verifier | Prove that the answer Google sends back belongs to the sign-in you started. | Up to 10 minutes |
sct_gsc_oauth | The same proof, when you connect a Search Console property. | Up to 30 minutes |
Set by Google
Google's sign-in prompt and reCAPTCHA can set their own. They sign you in or keep robots off our forms, so we count them as necessary.
| Cookie | Purpose | Lifetime |
|---|---|---|
g_state | Google sign-in: remembers that you closed its prompt, so it does not keep coming back. | Days; cleared when you sign in |
g_csrf_token | Google sign-in: an anti-forgery check. We accept a Google sign-in only when it matches. | Until you close your browser |
_GRECAPTCHA | reCAPTCHA, on the contact and sign-up forms: scores the visit, so a script cannot flood the form. | About 6 months |
3. Analytics and marketing cookies
None at the moment. No Google Analytics or Google Ads tag is set up on this site, so neither sets a cookie. If one is added, it is listed here, and it loads only after you allow its category.
4. Browser storage
When you are signed in, the app keeps some display settings in your browser's local storage: whether you finished the guided tour (sct.tour.done), and the date range, comparison period, sort order and page size you last used. They stay on your device, and clearing your site data resets them. Saved views and keyword watchlists are stored with your account, and the app keeps a copy in local storage so they open quickly.
5. Blocking cookies, and contact
You can block or delete cookies in your browser. Without sct_sess or _csrf you cannot sign in; the public pages still work, though the banner then asks on every page.
Cloudflare, our network provider, sees technical data such as your IP address on every request, and Google does on pages that load its sign-in prompt or reCAPTCHA (see the sub-processor list). Questions: [email protected].