Cookie Policy
LAST UPDATED · 2026-05-07
Summary
Brand Protector uses strictly-necessary cookies only: a sign-in session, CSRF protection, and short-lived HMAC tokens for platform-admin step-up and impersonation. We do not use analytics or marketing cookies, and we do not load third-party tracking scripts.
Strictly-necessary cookies are exempt from the GDPR / UK ePrivacy consent requirement, but we still disclose them here so you can see exactly what we set and why.
Cookie categories on this site
- Strictly necessary. Required for the service to function — sign-in, security, and admin controls. Cannot be turned off without breaking the app.
- Functional. None set by Brand Protector today.
- Analytics. None. We do not use Google Analytics, Plausible, Fathom, PostHog, Amplitude, Mixpanel, Heap, Hotjar, or any other analytics product.
- Marketing / advertising. None. We do not run retargeting pixels, conversion pixels, or any advertising trackers.
We do not use analytics or marketing cookies, and we do not load third-party tracking scripts.
Full list of cookies we set
The table below lists every cookie Brand Protector sets on its own domains. If something here looks wrong or missing, email privacy@brandprotector.io and we will reconcile within five business days.
| Cookie | Purpose | Category | Lifetime | Scope |
|---|---|---|---|---|
| __Secure-authjs.session-token (or authjs.session-token in dev) | Holds your signed-in JWT session. Required to access any tenant workspace or admin page. | Strictly necessary | Up to 8 hours (session lifetime); cleared on sign-out. | app.brandprotector.io and brandprotector.io |
| __Host-authjs.csrf-token (or authjs.csrf-token in dev) | CSRF token used by NextAuth to protect sign-in and sign-out POSTs. | Strictly necessary | Session (cleared when the browser closes). | app.brandprotector.io and brandprotector.io |
| __Secure-authjs.callback-url | Remembers the page you were on so we can return you there after sign-in. | Strictly necessary | Session. | app.brandprotector.io and brandprotector.io |
| __Secure-authjs.pkce.code_verifier / state / nonce | OAuth security parameters used during the Google sign-in handshake to prevent CSRF and replay attacks. | Strictly necessary | A few minutes; deleted as soon as sign-in completes. | app.brandprotector.io and brandprotector.io |
| bp_elevated | Short-lived HMAC-signed token proving a platform admin has just re-authenticated. Required for irreversible cross-tenant operations. Set only for platform-admin accounts. | Strictly necessary | 5 minutes. | app.brandprotector.io and brandprotector.io |
| bp_impersonate | Records that a platform admin is acting as a tenant member for support / debugging. Set only when a platform admin starts an impersonation session. | Strictly necessary | 1 hour. | app.brandprotector.io and brandprotector.io |
We also store a single localStorage flag (bp_cookie_disclosure_seen) so the cookie disclosure banner doesn't reappear on every visit. This value never leaves your browser.
Third-party cookies
When you upgrade or open the billing portal, Stripe Checkout runs on stripe.com and may set its own strictly-necessary cookies for fraud prevention and session continuity. Those cookies are governed by Stripe's cookie policy, not ours. Brand Protector does not embed Stripe.js on the marketing site.
We do not embed any other third-party JavaScript on the marketing or app pages.
Your choices
Because every cookie we set is strictly necessary, blocking them in your browser will break sign-in. If you want to use Brand Protector without our cookies, the most sensible option is to not sign up — the public marketing pages work fine with cookies blocked.
You can clear our cookies at any time using your browser's site-data controls. Doing so signs you out and you will need to sign in again on your next visit.
Changes to this policy
If we add a new cookie or change the purpose of an existing one, this page will be updated and the “Last updated” date at the top will change. If we ever introduce analytics or marketing cookies, we will replace the disclosure banner with a real consent flow before the new cookies are set.
Contact
Questions about this cookie policy? Email privacy@brandprotector.io. Our full Privacy Policy is at /privacy.