Cookies
Four cookies, all of them necessary to sign you in and keep the session safe.
Last updated 14 September 2026 · Privacy · Terms · Refunds · Cookies · DPA · Security
Why there is no banner
Consent is required for cookies that are not strictly necessary — advertising, analytics, tracking across sites. We set none of those. Every cookie below exists to make signing in work or to keep that session from being abused, which is the exemption a banner would be asking you to waive.
We do not use Google Analytics or any third-party analytics on this site, and we do not embed trackers.
The live demo on the home page uses Cloudflare Turnstile to tell people from bots. It is a security measure, not tracking: it loads from Cloudflare only when you start using the demo, and our privacy policy describes what it processes.
What we set
| Cookie | Purpose | Category |
|---|---|---|
urlshot_session | Keeps you signed in to the dashboard.Set after sign-in, HttpOnly so page scripts cannot read it, and cleared when you sign out or close your account. | Strictly necessary |
urlshot_csrf | Protects against cross-site request forgery.Readable by the dashboard so it can echo the value in a request header. It is not an identifier and carries no personal data. | Strictly necessary |
urlshot_session_hint | Shows the right navigation on the marketing site.A single non-sensitive flag on urlshot.io saying a dashboard session exists, so the header can show "Dashboard" instead of "Login". It is never treated as authentication: clicking through still requires a real session. | Strictly necessary |
urlshot_oauth | Completes signing in with Google safely.Set only when you choose Continue with Google, for at most ten minutes. It ties the answer from Google to the browser that asked, so nobody can sign you in to their account, and is deleted as soon as you return. | Strictly necessary |
Turning them off
Your browser can block or clear them. Blocking urlshot_session or urlshot_csrf means the dashboard cannot sign you in — they are how a signed-in request is recognised and how it is protected. Blocking urlshot_session_hint costs nothing but a slightly wrong link in the marketing header.
The API itself uses no cookies at all. Requests to api.urlshot.io authenticate with a bearer token, so anything you build against us is unaffected by this page.
Questions
hello@urlshot.io. Our privacy policy covers everything else we collect.