Legal
Cookie Policy
Last updated · Version cookies-2026-10-28
What this covers
This Cookie Policy explains the cookies and similar technologies Smart Site Plan uses, why we use them, and how you can control them. It supplements our Privacy Policy. Cookies are small files stored in your browser; we also use comparable browser storage (local storage and session storage), and the controls below apply to both. Everything we set is first-party, set by Smart Site Plan for Smart Site Plan. No advertising or analytics vendor sets cookies or reads browser storage on our pages. The one third party that can set a cookie on our site is Cloudflare, which delivers and protects it: see Security below.
Essential
These are needed for the Service to work, so they cannot be turned off: they keep you signed in, secure your session, remember your privacy choice, and count the free usage your plan allows. In production the sign-in cookies carry the __Secure- prefix and are set with the HttpOnly, Secure, and SameSite=Lax attributes.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in and secures your session. | Cookie | Up to 30 days |
| better-auth.session_data | Short-lived cache of your session so pages load without a round trip. | Cookie | 5 minutes |
| better-auth.two_factor | Tracks a pending two-factor step while you sign in. | Cookie | Sign-in attempt |
| better-auth.trust_device | Remembers a device you marked as trusted so two-factor is not asked every time. | Cookie | Until it expires or you sign out |
| better-auth.state | Protects single sign-on and OAuth redirects against cross-site request forgery. | Cookie | Sign-in attempt |
| ssp_consent_region | Records which privacy regime applies to your visit, so we apply the correct default and only show the consent banner where the law requires one. It holds one of two words and no location detail. | Cookie | 24 hours |
| ssp:cookie-consent-v1 | Remembers your analytics choice on this device. | Local storage | Until you clear it; asked again after 13 months where consent is required |
| ssp-exp-anon-device | A random device token signed by our servers. Free usage is counted against it (the weekly allowance of a free account, and the daily allowance without an account), so a limit cannot be reset by making another account. It holds no name or email address. | Local storage | Until you clear it; the counts kept against it expire within about eight days |
Security
Cloudflare, our content delivery and bot protection provider, may set short-lived security cookies (such as __cf_bm and cf_clearance) to tell people from automated traffic, and runs its Turnstile check on sign-in, sign-up, and public share and form pages. These are needed to protect the Service and are not used for advertising. Cloudflare is listed in our Sub-Processor Register.
Optional analytics
We measure how the product is used ourselves, on our own servers, so we can improve it. No analytics vendor receives the data. What is recorded, and the service records our servers keep whatever you choose, are described in Section 7 of our Privacy Policy. Which default applies to you depends on where you are:
- European Economic Area, United Kingdom, Switzerland, Brazil, and Quebec: the law requires your consent before we store anything non-essential on your device, so optional analytics stays off, and none of the items below are set, until you opt in through the cookie banner.
- Everywhere else, including the United States: no consent is required in advance, so optional analytics is on by default and you can turn it off whenever you want. We show no banner, because a standing control and a respected Global Privacy Control signal are what these laws ask for.
Either way the control is the same and it is always available: the analytics control on the Privacy Policy page, which remembers your choice on this device. Turning it off stops your browser sending usage events and stops us keeping the text of your searches; the items below are then no longer used.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| ssp:aid | A random identifier for this browser, used to count visits and, when you sign in or sign up, to link this browser's earlier usage events to your account. | Local storage | 13 months, and replaced when you sign out |
| ssp:sid | A random identifier for this visit, with the referring website's domain and any campaign tags, used to group page views into one visit. | Session storage | Ends with the browser session, or after 30 minutes without activity |
| ssp:aq | Up to 200 usage events waiting to be sent when a connection drops, so they are not lost. | Local storage | Until sent; cleared when you turn analytics off or sign out |
Attribution and other first-party storage
On your first visit we set a first-party attribution cookie so we can understand how people find us and what convinced them to sign up. It is never shared with advertisers and is not used for advertising or cross-site tracking. A Global Privacy Control signal keeps optional analytics off; the attribution cookie remains first-party only. Other browser storage holds your preferences and work in progress (for example the theme, panel layout, and unsent drafts) and identifies no one.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| ssp_attribution | Remembers the page you arrived on, any campaign tags, and which button or card on our own site you clicked before signing up. If you create an account, this is stored once with your account. | Cookie | Up to 90 days |
| ssp-gallery-device | A random identifier that lets the public Site Plan Gallery count one admire per device, without an account. | Local storage | Until you clear it |
Managing cookies
You can control cookies and browser storage in several ways:
- Use the analytics control on our Privacy Policy page to turn optional analytics on or off at any time.
- Use your browser settings to block or delete cookies and site data. Blocking essential cookies will stop you from signing in, and clearing site data resets your choices on this device.
- Global Privacy Control: if your browser or an extension sends a GPC signal, we treat it as a request to keep optional analytics and the keeping of search text off, in every region and regardless of any earlier choice. Your browser sends no usage events, and the cookie banner is not shown, so you are not asked again. The essential items and the service records described in our Privacy Policy continue.
- Do Not Track: our websites do not respond to Do Not Track signals, because there is no common standard for what they mean.
Changes and contact
We may update this Cookie Policy from time to time. For questions, contact privacy@smartsiteplan.com.