Cookie Policy
Last updated: September 23, 2026
1. WHAT ARE COOKIES
Cookies are small text files stored on your device when you visit a website. They serve various purposes such as remembering your preferences and enabling core functionality.
2. COOKIES WE USE
| Cookie / Storage | Type | Purpose | Duration |
|---|---|---|---|
| jwt | Essential | Authentication session for logged-in users | 24 hours |
| cf_clearance | Essential | Cloudflare Turnstile bot protection | Up to 30 min |
| cookie_notice_acknowledged | Essential local storage | Remembers that the cookie notice was dismissed | Until browser data is cleared |
| analytics_consent | Essential local storage | Records whether you accepted or declined optional dashboard analytics | Until browser data is cleared |
| _clck / _clsk | Analytics (dashboard only) | Microsoft Clarity product analytics and session replay in the signed-in dashboard. Enabled by default outside the EU/EEA/UK, and on opt-in for EU/EEA/UK visitors; you can opt out anytime | Up to 1 year |
| marketing_consent_v1 | Essential local storage | Records whether you accepted or declined optional advertising measurement | Until browser data is cleared |
| _fbp / _fbc | Advertising (opt-in) | Meta Pixel browser and ad-click identifiers, set only after you allow advertising measurement | Up to 90 days |
| /cdn-cgi/rum | Performance measurement | Cloudflare Web Analytics / Browser Insights performance beacon | Current page view |
Essential cookies are required for the Service to function. Cloudflare performance measurement is provided by Cloudflare and does not require OpenSERP to set analytics cookies.
3. THIRD-PARTY COOKIES
- Cloudflare Turnstile: We use Cloudflare's Turnstile service for bot protection on forms. Turnstile is designed to be privacy-preserving and does not track users across sites. It may set a temporary cookie (cf_clearance) to verify your session.
- Cloudflare Web Analytics / Browser Insights: Cloudflare may run a RUM performance beacon from users' browsers and send performance metrics to our domain's
/cdn-cgi/rumendpoint. According to Cloudflare, this beacon does not store or access cookies, localStorage, sessionStorage, or IndexedDB. - Microsoft Clarity: In the signed-in dashboard only, we use Microsoft Clarity to understand how the dashboard is used (aggregate usage, heatmaps, and session replay) so we can improve it. For visitors in the EU, EEA, and UK it loads only if you opt in via our cookie notice; elsewhere it is enabled by default and you can opt out at any time. We also honour your browser's "Do Not Track" / Global Privacy Control signal as an opt-out. Clarity is configured to mask all text and input fields, so account content such as API keys, balances, and search query text is not captured, and sessions are tied only to a one-way hashed account identifier, never your email or raw account id. It sets its own cookies (for example
_clckand_clsk). If you opt out, Clarity is not loaded and these cookies are not set. - Meta Pixel: Loaded only if you allow advertising measurement. It sets
_fbpand, when you arrive from a Meta ad,_fbc. See section 5.
4. ANALYTICS
We use Cloudflare Web Analytics / Browser Insights for performance measurement across the site. In the signed-in dashboard we additionally use Microsoft Clarity. For EU/EEA/UK visitors it runs only on opt-in; elsewhere it is on by default and can be turned off at any time using "Necessary only" or "Customize" in our cookie notice, or "Cookie settings" in the site footer. We honour "Do Not Track" / Global Privacy Control as an opt-out, and you can use the dashboard normally either way. We do not intentionally send API keys, authentication tokens, dashboard content, search query contents, or private account data to analytics; Clarity is configured to mask all text and input fields, and identifies sessions only by a one-way hashed account identifier.
5. ADVERTISING MEASUREMENT
With your optional advertising consent, Meta Pixel measures visits and Meta Conversions API measures completed registrations. Meta receives browser identifiers, browser information, and a SHA-256 hash of your email address for ad attribution. A hash is still personal data. We do not send passwords, API keys, search queries, or balances.
Advertising measurement is off until you opt in. You can withdraw consent for future events at any time in Cookie settings. Events already sent cannot be recalled. Advertising cookies last up to 90 days; queued matching data is deleted after delivery or within six days. See the Meta Privacy Policy.
6. MANAGING COOKIES
You can change your choices for optional analytics and advertising at any time in .
You can also control cookies through your browser settings. Note that disabling essential cookies may prevent the Service from functioning correctly - specifically, you will not be able to stay logged in.
Most browsers allow you to:
- View what cookies are set
- Delete individual or all cookies
- Block cookies from specific or all sites
- Set preferences for first-party vs third-party cookies
7. CHANGES TO THIS POLICY
We may update this Cookie Policy to reflect changes in our practices or for legal reasons. Changes will be posted on this page with an updated date.
8. CONTACT
For questions about our use of cookies, contact us at privacy@openserp.org .