1. The short version
We only use cookies and similar storage that are strictly necessary — the things without which something you asked for cannot work. We do not use analytics cookies, advertising cookies, social-media pixels, or any form of cross-site or cross-device tracking, on our own service or on the websites our customers publish.
That is why you will not see a cookie banner on SinceCode, or on a website built with it. Under the Privacy and Electronic Communications Regulations 2003 ("PECR"), consent is required for storage that is not strictly necessary. We have kept to the strictly necessary, so there is nothing to ask you about.
2. What this policy covers — and who is responsible
There are two different things here, with different people responsible for them:
- The SinceCode service itself — sign-up, the dashboard and the website editor. SinceCode LTD is the controller, and this policy is our own statement.
- A website published using SinceCode. The person or business who built that site is the controller for its visitors' data; we are their processor under our Data Processing Agreement. This policy describes what our platform stores on a visitor's device when it renders their site, which is what we are responsible for. Section 8 covers what a site owner can add themselves, which we are not.
3. What we mean by "cookies"
A cookie is a small file a website asks your browser to keep. The law here is not actually about cookies specifically: PECR covers storing information, or gaining access to information stored, in your device. The same rules therefore apply to browser storage such as localStorage, to offline caches, and to service workers — and this policy treats them the same way. Where we store something that is not a cookie, it is listed in section 7 alongside the cookies rather than left out on a technicality.
4. Why we say "strictly necessary"
PECR Regulation 6(4) exempts storage that is "strictly necessary for the provision of an information society service requested by the subscriber or user". The test is not whether we find something useful — it is whether you asked for the thing it makes possible.
Every entry below is there because something you actively did cannot work without it: staying signed in, finishing a sign-in you started, opening a gallery you have the password for, editing an RSVP you already sent. None of them identifies you across other websites, and none is shared with an advertiser.
Several of the visitor-side entries are created only after you do something — enter a password, submit a reply, save a draft. Until then, a published SinceCode site stores nothing on your device at all.
5. Cookies on the SinceCode service
These appear when you use SinceCode as a customer. Most are set by our authentication library and exist only to sign you in safely.
| Name | What it does | Lifetime |
|---|---|---|
authjs.session-token__Secure-authjs.session-token | Keeps you signed in. The __Secure- version is the one used in production; the other exists only for local development without HTTPS. | 30 days |
authjs.csrf-token__Host-authjs.csrf-token | Protects the sign-in form against cross-site request forgery. | Session |
authjs.callback-url__Secure-authjs.callback-url | Remembers the page you were trying to reach, so you land there after signing in rather than somewhere generic. | Session |
authjs.pkce.code_verifier__Secure-authjs.pkce.code_verifier | Part of the "Continue with Google" handshake you started. | 15 minutes |
authjs.state__Secure-authjs.state | The OAuth state value, which prevents a sign-in being hijacked mid-flow. | 15 minutes |
authjs.nonce__Secure-authjs.nonce | Replay protection for the identity token Google returns. | 15 minutes |
sc_signup_marketing | Carries the marketing opt-in you ticked on the sign-up form across the Google redirect, so your choice is recorded against the new account. Read once, at account creation. | 10 minutes |
sc-impersonate | Set only while a SinceCode administrator is signed in as a customer to investigate a problem that customer reported, and only where that customer granted access — which they can revoke at any time. Never set on an ordinary session. | 1 hour |
6. Cookies on a website built with SinceCode
Simply visiting a published SinceCode site sets no cookies at all. The entries below appear only once a visitor uses the particular feature each one supports.
| Name | Created when | What it does | Lifetime |
|---|---|---|---|
scgv | You enter the correct password for a locked photo gallery. | Proves this browser passed that gallery's password, so the protected photos can be shown. It is the equivalent of being signed in to that one gallery. | 7 days |
scgs | You mark your first favourite in a photo gallery. | A random identifier, so your selection is still there when you come back and the photographer can see what you chose. Scoped to that gallery. | 180 days |
sc_rsvp | You submit an RSVP to an event as a guest, without an account. | Lets you return and change your own reply. Without it there is no way to find your response again. | 180 days |
sc_pw | You upload a photo to an event photo wall where the host has set a per-guest limit. | Counts how many uploads this device has left. Not set at all when the host has set no limit. | 180 days |
sc_anon | You save a draft invitation before creating an account. | A random identifier, so your draft is still there when you return and can be claimed into your account if you sign up. | 30 days |
All five are first-party, hold a random value rather than anything about you, and are readable only by the site that set them.
7. Other things stored on your device
| What | When | Why |
|---|---|---|
An offline cache (sc-shell-v2) | Only if you install SinceCode as an app on your device. | Holds our own offline page and icon so the dashboard still shows something useful without a connection. No personal data. |
| A service worker for an event site | An event page, only after you tap "Yes" to updates from the host. | Push notifications cannot work without one. It is not installed for guests who do not opt in. |
sc_event_push_dismissed_… | An event page, only if you dismiss the notifications prompt. | Remembers that you said no, so you are not asked again on every page. |
8. Content from other companies on published sites
A site owner can put a map or a video on their page. Ordinarily an embed like that contacts the provider — Google, YouTube, Vimeo — the moment the page loads, before the visitor has done anything, setting third-party cookies nobody asked about.
We do not do that. Maps and videos on a SinceCode site show a placeholder with a button that names the company you are about to contact. Nothing is requested, and nothing is stored, until you press it. If you never press it, that provider never learns you visited the page.
Two related points, for completeness:
- Images. Photographs on a SinceCode site are normally served from our own media host. A small number of older templates still load their photographs from a third-party image library. That library sets no cookies, but it does mean it can see the visiting browser's IP address. We are moving those images to our own hosting.
- Custom code. Business and higher plans let a site owner paste their own HTML, CSS or tracking code into their site. Anything it does — including setting cookies — is that owner's responsibility as controller, not ours, and our Acceptable Use Policy requires them to obtain whatever consent the law demands for it. If you are a site owner using that feature, see section 10.
9. What we deliberately do not do
- No analytics cookies. Visitor statistics for a published site are counted on our servers from the page request itself. Nothing is stored on the visitor's device to do it, and the figures the owner sees are aggregate.
- No advertising or re-targeting cookies, and no advertising network is present on any page we serve.
- No social-media pixels. Where a site links to Facebook, Instagram, LinkedIn, TikTok or Pinterest, those are ordinary links — nothing is sent to them unless the visitor clicks.
- No fingerprinting. We do not try to identify a device by its configuration, and we do not attempt to recognise you across different websites or devices.
- No selling or sharing. None of the values above is passed to a third party.
10. If you publish a site with SinceCode
For your own visitors, you are the controller. What we hand you is a platform that, left as it is, needs no cookie banner — and it is worth keeping it that way. If you add your own tracking, advertising or analytics code, that is your decision and your legal responsibility: you will normally need a consent mechanism and a cookie notice of your own before it runs. Our Data Processing Agreement sets out the split, and the Acceptable Use Policy the rules.
11. Managing cookies in your browser
Every major browser lets you see, block and delete cookies and site data, usually under Settings → Privacy. Because everything we set is strictly necessary, blocking it does not remove tracking — there is none to remove — but it will break what it supports: you will be signed out, a gallery password will need re-entering, and an RSVP will no longer be editable.
12. Changes and contact
We update this policy when what we store changes. Past versions are at /cookies/history, and material changes are notified to account holders and require re-acceptance.
Questions, or a request about your data, go to privacy@sincecode.com. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
If your question is about a specific website built with SinceCode rather than about SinceCode itself, that site's owner is the controller and is the right first contact.