Cookie Policy
Last updated: November 9, 2026
1. Zero Cookies for Normal Visitors
Normal visitors browsing SurfaceScan, reading documentation, or running domain scans receive zero HTTP cookies. We do not set any advertising, tracking, or cross-site profiling cookies, and no third-party marketing scripts are executed.
Furthermore, our typography and style bundles are completely self-hosted, eliminating any third-party asset requests. Only when a user explicitly signs in via /login (surfacescan_session, HttpOnly, SameSite=Lax, 30 days) or when a site operator signs into the private administration console (admin_session, HttpOnly, SameSite=Strict, Secure over HTTPS, scoped to /admin, 8 hours) is a strictly necessary session cookie issued.
2. Client-Side Local Storage
To maintain your user interface preferences without requiring an account, SurfaceScan utilizes standard browser localStorage for strictly functional purposes:
| Key | Purpose | Duration |
|---|---|---|
| cookie_notice_dismissed | Stores whether you dismissed the cookie notice card so it does not reappear. | Persistent |
| lang | Remembers your preferred language selection (English or Azerbaijani). | Persistent |
| fixlist:<domain> | Saves your checklist completion progress in the AI advisor section for a scanned domain. | Persistent |
3. How to Clear Local Storage
You can clear these preferences at any time through your browser's developer tools or settings under "Clear Site Data".