Cookie Policy
Last updated: 21 April 2026
This page describes the cookies SERPTool places on your device and how to control them. By using the service you agree to our use of strictly necessary cookies; all other categories are opt-in and can be toggled any time from the preferences dialog.
1. What is a cookie?
A cookie is a small piece of data a website stores in your browser so that subsequent requests can be recognised. Cookies can be strictly necessary (for sign-in, security), functional, analytical, or used for marketing.
2. Cookies SERPTool uses today
Strictly necessary (always on)
| Name | Purpose | Lifetime |
|---|---|---|
authjs.session-token | Auth.js session (JWT). Identifies your signed-in session. | 30 days |
authjs.csrf-token | CSRF protection for authentication POSTs. | Session |
st_consent | Stores your consent choices so we don't re-prompt on every page. | 12 months |
These cookies are essential to deliver the service. Disabling them means you can't sign in or record your consent preferences. Under GDPR and the UK PECR, consent is NOT required for strictly necessary cookies.
Functional (opt-in, not used today)
Reserved for future use — we'd place here a cookie that remembers UI preferences like chosen filter defaults. Off by default.
Analytics (opt-in — Google Analytics 4)
We use Google Analytics 4 to understand aggregate, non-identifying usage patterns (pages visited, devices used, rough geography) so we can improve the product. GA4 runs in Consent Mode v2: until you tick the Analytics box, only cookieless pings are sent and no cookies are written to your browser. Once accepted, the following cookies are placed by googletagmanager.com on your behalf:
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Distinguishes unique visitors (client ID). | 2 years |
_ga_<container-id> | Session state for this specific GA4 property. | 2 years |
_gid | Distinguishes unique visitors over a 24-hour window. | 24 hours |
Data is processed by Google LLC. You can opt out at any time from the preferences dialog — when you do, Consent Mode is flipped to denied and existing GA cookies stop sending identifiable data. See Google's privacy policy and the GA opt-out browser add-on.
Marketing (opt-in, not used today)
Reserved. We do not currently run ads or retargeting.
3. Third-party cookies
When you're redirected to Stripe for checkout or the billing portal, Stripe sets its own cookies on its own domain for fraud prevention and session management. We do not control those; see Stripe's cookie policy. Stripe is only loaded when you click a checkout or billing-portal button — it is not loaded on every page.
4. Managing your preferences
You can change your choices at any time by clicking . Your new selection is stored in the st_consent cookie and takes effect immediately on the next page load. You can also delete cookies entirely through your browser settings.
5. Changes to this policy
If the cookies we use change, we'll bump the consent version and re-prompt you. The "Last updated" date at the top of this page always reflects the most recent revision.
6. Contact
Questions: use the contact form.