Cookie Policy

Everything below is strictly necessary for the dashboard to work as you left it. None is used for advertising or shared with anybody, so there is nothing to consent to, which is why we do not ask - a banner asking permission for a login cookie is a banner that teaches people to dismiss banners.

buildly_at (cookie): Keeps you signed in: carries your short-lived access token. HttpOnly, so scripts cannot read it. Lasts: 30 days. Strictly necessary, so it needs no consent.

buildly_rt (cookie): Keeps you signed in: carries the token that renews your session. HttpOnly, so scripts cannot read it. Lasts: 30 days (or until you sign out). Strictly necessary, so it needs no consent.

buildly_rail (cookie): Remembers whether you left the sidebar open or closed. Holds no identity. Lasts: 1 year. Strictly necessary, so it needs no consent.

buildly_console_sections (cookie): Staff console only: remembers whether you left the section pages open or folded. Holds no identity. Lasts: 1 year. Strictly necessary, so it needs no consent.

buildly_google (cookie): Only while signing in with Google: ties Google's answer to the sign-in this browser started. Deleted when it comes back. Lasts: 10 minutes. Strictly necessary, so it needs no consent.

buildly-theme (local storage): Remembers your light or dark preference. Never sent to us. Lasts: Until you clear your browser data. Strictly necessary, so it needs no consent.

buildly:signed-in, buildly:signed-out, buildly:pending-toast (session storage): Carries a one-time confirmation message across a page change, such as "Signed in". Lasts: Until you close the tab. Strictly necessary, so it needs no consent.

buildly:unsaved-post:* (session storage): Keeps an unsaved blog draft in this tab so a reload does not lose it. Lasts: Until you close the tab. Strictly necessary, so it needs no consent.

A generated site stores nothing in your browser until you choose. If the site has analytics, you see a choice before anything is counted, with Accept and Refuse as equal buttons. The analytics script is only put on the page if you accept: refusing, ignoring the choice, or sending a Global Privacy Control signal means it is never loaded at all.

Your answer is the only thing stored, and it is stored only when you press a button. You can change it at any time with the "Change analytics choice" control at the bottom of the page.

site_consent (cookie): Remembers your answer to the analytics question on a site that has analytics. Set only when you press Accept or Refuse. HttpOnly. Lasts: 180 days. Strictly necessary, so it needs no consent.

bc_consent (cookie): Remembers your answer to the analytics question on a site whose own design draws the cookie banner. Set only when you answer, by the banner itself; until then no analytics is loaded. Lasts: 180 days. Strictly necessary, so it needs no consent.

umami.disabled (local storage): Set only after you withdraw an analytics choice you gave earlier on the same page, so the tool that was already running stops counting you. Holds no identity. Lasts: Until you clear your browser data or allow analytics again. Strictly necessary, so it needs no consent.

If the site’s owner connects analytics or advertising tools of their own, those tools set their own cookies under their own terms, and the owner is responsible for obtaining consent for them.

Contact forms on generated sites are protected against automated submissions by a self-hosted captcha service that checks a token when the form is sent. We have not verified whether it stores anything in the visitor’s browser, so this is stated as unverified rather than as a promise either way. [OWNER: confirm with the captcha service’s documentation.]

Buildly’s own sign-up form and its report-an-abusive-website form use the same self-hosted captcha service, and a small proof of work that your browser solves in the background. Neither is used to follow you across sites or to build a profile; each exists only to tell a person from a program. We do not keep the result of the check in our database. Your browser sends the captcha service the address of the page it is loaded from, as any request does. As above, whether the captcha stores anything in your browser is unverified. [OWNER: confirm with the captcha service’s documentation.]