Cookies

Last updated 8 August 2026

This page is short because there isn't much to disclose. Everything here is either strictly necessary — which the law exempts from consent — or loads only after you say yes to the banner.

phishtriage.com — this site

By default, sets no cookies at all. Two things it may store, both with clean rules:

• pt-consent — your answer to the analytics banner, in the browser's local storage. Remembering your choice is itself strictly necessary; it never leaves your device. Change it any time via Cookie preferences in the footer — withdrawing is one click, same as consenting was.
• Analytics — only with your consent. If you click Accept on the banner, we load Google Analytics, which sets Google's measurement cookies (_ga family) under Google's cookie policy. If you decline — or simply never answer — the Google script is not merely disabled, it is never fetched. Advertising and ad-personalization signals are hard-denied even after consent.

portal.phishtriage.com — your dashboard

Two pieces of storage, both doing exactly what they say:

• phishtriage_session — a cookie that keeps you signed in. Set only after you sign in, HttpOnly (scripts can't read it), SameSite=Lax (other sites can't send it). Deleted when you sign out.
• pt-theme — your light/dark preference, kept in the browser's local storage. It never leaves your device.

Signing in uses Google Sign-In; Google's own widget may set cookies on Google's domains under Google's cookie policy. We never see those.

Cloudflare

Our sites are served through Cloudflare, which may set operational security cookies (such as __cf_bm) to tell humans from bots. These are strictly necessary for keeping the service up and are described in Cloudflare's cookie documentation.

What we don't do

No advertising or retargeting, no cross-site tracking, no fingerprinting — on this site, in the portal, or in the extension. Analytics exists only on this site, only after your explicit yes, and never in the portal or the extension.

Questions: [email protected]. What we store on our servers (scans, verdicts) is a different topic — that's the privacy policy.