1. Cookies and similar storage
Cookies are small values saved by a website in your browser. Similar technologies include local storage. A cookie policy should explain both, even when the application does not set a traditional cookie.
PacketShield's application code does not set analytics, advertising or marketing cookies, use device fingerprinting for marketing, or load third-party advertising or analytics scripts. Its font is hosted locally. Necessary application cookies keep you signed in and secure Google or Apple registration. The hosting platform may separately use necessary authentication and security technologies.
2. Application storage inventory
| Technology | Purpose | Duration |
|---|---|---|
packetshield-themeFirst-party preference cookie | Saves your chosen light or dark theme across PacketShield subdomains. Contains only the theme name. | Up to 1 year. Change it using the theme switch or clear it in browser settings. |
__Secure-authjs.session-tokenFirst-party cookie, including numbered chunks when needed | Encrypted account session, checked against the registered account before an order. Secure and HttpOnly on HTTPS. | Up to 7 days. Cleared on sign-out. |
__Secure-authjs.state, __Secure-authjs.nonce, __Secure-authjs.pkce.code_verifier | Protect sign-in against forged requests and replay. Secure and HttpOnly. Apple state and nonce cookies permit the secure cross-site return. | 15 minutes, removed after the sign-in callback. |
__Host-authjs.csrf-token and __Secure-authjs.callback-url | Protect sign-in and sign-out forms and return you to your selected plan. Secure and HttpOnly. The callback cookie permits the secure cross-site Apple return. | Browser session. |
packetshield.cookie-preference.v1Local storage, first party | Records a necessary-only choice when you explicitly save it. Includes the choice, policy version, saved time and expiry time. No unique marketing identifier. | 180 days. Removed when settings are next opened after expiry, or when you remove the saved choice. |
| Form state Page memory | Holds example plan and configuration selections while the page is open. This is not a persistent cookie. | Current page session. |
| Analytics and advertising | Not installed. No optional tracking category can be enabled in this preview. | Not applicable. |
The browser preference is not shared with advertising services and is not consent to new purposes. Saving a choice does not change necessary sign-in or hosting-provider storage. Local development uses the same application cookie names without the HTTPS security prefixes. Necessary sign-in cookies are used only when authentication is configured; they are not optional tracking cookies.
Registration security
The registration page loads Cloudflare Turnstile for bot verification. It processes security signals under Cloudflare's privacy policy. A first-party __Host-packetshield-registration cookie holds an opaque verification ticket for up to ten minutes. It is Secure, HttpOnly and removed after the provider callback. It is used to require bot verification and terms acceptance before account creation. It is not used for advertising. No Cloudflare pre-clearance cookie is enabled by this widget.
Billing sign-in storage
The billing workspace sets a host-only __Host-packetshield-billing-state cookie for up to fifteen minutes during sign-in. It is Secure, HttpOnly and SameSite=Lax, and is removed after the single-use account handoff. Billing uses its own host-only encrypted __Secure-authjs.session-token cookie for up to seven days. Signing out of billing clears the billing cookie; signing out of the panel clears the panel cookie. Account deletion removes the backing account records and prevents either session from accessing customer data.
3. Sign-in, hosting and payment providers
If you choose Google or Apple, you leave this site for the selected provider's sign-in page. The provider controls cookies on its own pages. Its privacy policy is linked from our privacy policy.
This site uses Cloudflare hosting. Hosting providers may use necessary security technologies for their services. Account sign-in is handled by PacketShield and the selected identity provider.
Stripe is not loaded on this page. If test checkout is enabled and you choose to continue, you leave for Stripe's hosted checkout. Stripe may use cookies and similar technologies on its own pages. See Stripe's cookie policy, Stripe's privacy policy and the hosting providers' policies linked from our privacy policy.
4. Managing your preference
Open Cookie settings in the footer. Save necessary only writes the preference to this browser. Remove saved preference deletes it. The setting applies only to the browser and site origin where you save it.
If storage is blocked, the site remains usable and no optional tracking is enabled. You can also clear this site's data through browser settings. Removing authentication cookies signs you out. Removing the saved cookie preference does not delete your account or end your sign-in session. Platform authentication storage is separate and may sign you out of a private preview when removed.
5. Future optional technologies
Optional technologies are absent from the current preview. They will not become enabled by a saved necessary-only preference. Before adding analytics, advertising or embeds, the operator must update the inventory and implement any legally required choices or consent before those technologies load. A policy link alone is not a consent mechanism.
6. Questions and updates
The operator and privacy contact are pending, as explained in the draft notice above. This policy will be revised when the application or provider technologies change. Check the revision date before relying on a previous copy.
Preparation reference: ICO guidance on storage and access technologies. Exceptions and consent requirements depend on the applicable law and actual purpose.