Effective date: 14 October 2026 · Version: 1.0
This notice explains the cookies and similar technologies used on scandefend.com (our website) and app.scandefend.com (the ScanDefend app). ScanDefend is a trading name of IronSky Limited. For everything else about personal data, see the Privacy Notice.
In short: we use only cookies and device storage that are strictly necessary for the service you ask for, or that remember choices you make in the app. We use no advertising, tracking or analytics cookies, so we don't show a cookie banner.
1. Cookies set by ScanDefend
All of these are set by app.scandefend.com only, are sent only over HTTPS, can't be read by page scripts (HttpOnly), and are not shared with other websites (SameSite=Lax). None is used for tracking or advertising.
| Name | Purpose | Lifetime |
|---|---|---|
__Host-cf_claim |
Your claim session: links this browser to your wallet, scan progress and preview before you have an account. Set when you start checkout. Contains a random identifier; we store only a one-way hash of it. | Up to 7 days; ended when you save your scans to an account |
__Host-cf.session_token |
Keeps you signed in to your account | 7 days, renewed while you use the app; removed when you sign out |
__Host-cf.ml_bind |
Ties an email sign-in link to the browser that asked for it, so a link opened elsewhere can't take over your session | 15 minutes |
__Host-cf.state |
Protects sign-in with Google or another provider against forgery | 5 minutes |
__Host-cf.passkey_challenge |
Protects passkey sign-in and passkey set-up against replay | 5 minutes |
2. Device storage in the app
The app keeps a few conveniences in your browser's local or session storage, for example the order you are checking out, websites you were about to scan, recently viewed scans on this device, whether you collapsed the sidebar, whether you dismissed the "add a passkey" prompt, and, if you ticked the box for security tips when creating an account and then continued with Google or Apple, that you ticked it (session storage sd-register-tips: the time only, kept at most one hour and used once, so we can send the confirmation email after you sign in). These never give access to anything, aren't sent to us for tracking, and stay on your device. Sign-in and claim tokens are never stored there or in web addresses.
3. Cloudflare
- Turnstile. On checkout, resume-link requests, newsletter sign-up, the site-owner forms and sending a "What was missing?" note, Cloudflare Turnstile checks that a person, not a bot, is making the request. It processes signals from your browser and device to do this, as described in Cloudflare's Turnstile Privacy Addendum. It is a security measure for the service you are using.
- Network security. Our websites run on Cloudflare's network. If Cloudflare's security features are triggered (for example during an attack), Cloudflare may set its own strictly necessary security cookies. We don't use them for anything else.
4. Performance and page-usage measurement
On scandefend.com, about 1 in 10 page views sends a first-party page-speed measurement to our own servers: the metric name and value, the page path (only from a fixed list of our own pages) and the navigation type. It sets no cookies and reads or stores nothing on your device. We don't store your IP address or browser details with it; your IP address is used only for a moment to apply rate limits. The measurements are kept in aggregate for up to 3 months and are not linked to any person. We use them only to keep the website fast.
We also count how pages and articles are used (views, reads, clicks on links to the ScanDefend app, newsletter sign-ups and "Was this helpful?" answers), with the kind of place the visit came from and any campaign tags in the link. This is first-party and aggregate: each message adds one to a daily count for that page, with no cookies, nothing stored on your device and no IP address or browser details stored. Links to the app carry the page they were on so we can count sign-ups and orders per page; for a checkout it is held only until the order is counted (or the payment ends) and is not kept with the payment record. Optional "What was missing?" notes are pseudonymous: we ask people not to put personal details in them, they are checked with Cloudflare Turnstile when sent, and they are deleted after 90 days. For abuse limits we keep a daily-changing keyed code of the visitor's IP address for 2 days. Browsers that send Do Not Track or Global Privacy Control are not counted. Daily counts are kept for up to 25 months. Ad campaign labels from a link you followed travel to the app in the web address and in the app's memory only; nothing about them is stored on your device. When you start a checkout we keep the labels with the payment record for 90 days to count which campaigns lead to paid orders; for visitors outside the EEA, the UK and Switzerland we also keep the ad click identifier (gclid, gbraid or wbraid) for the same 90 days to measure which ads lead to purchases. We do not keep it for visitors in the EEA, the UK or Switzerland. Browsers that send Do Not Track or Global Privacy Control are not measured this way.
5. What we don't use
- No analytics cookies and no third-party analytics tools. The page counts in section 4 are our own, aggregate and cookie-free.
- No advertising, retargeting or cross-site tracking cookies.
- No social-media tracking pixels.
If this changes, we'll update this notice first, and we'll ask for your consent where the law requires it.
6. Staff systems
Staff-only systems (admin.scandefend.com) use their own sign-in cookies, including Cloudflare Access. They aren't used by customers or visitors.
7. Managing cookies
You can delete or block cookies and site data in your browser settings. If you block the cookies in section 1, checkout, sign-in and access to your scans won't work. If you clear the claim cookie before saving your report, you can get back in with the resume link we email to your checkout address.