Legal

Cookie statement

Draft, pending legal review. Version 2026-11-01.

Anchr.ing uses only cookies that are strictly necessary for signing in and keeping you signed in, so they need no consent. None of them is used for advertising or to follow you across sites. Below is every cookie and browser storage entry we set.

Sign-in pages (every project's sign-in host)

These are set by the sign-in host of a project, such as acme.prod.anchr.ing. They are __Host- cookies: HttpOnly, Secure, bound to that one host.

NamePurposeLifetime__Host-kh_sessionKeeps you signed in on this host14 days at most; ends after 3 days without use__Host-kh_csrfProtects forms against cross-site request forgeryUntil the browser closes__Host-kh_email, __Host-kh_link, __Host-kh_mfa, __Host-kh_mfa_enrol, __Host-kh_recover, __Host-kh_email_changeTie a step of signing in, setting up a second factor, resetting a password or changing an email address to this browserMinutes, until the step is done or its code expires__Host-kh_social, __Host-kh_sso, __Host-kh_samlCarry a sign-in with Google, Microsoft, an organisation's SSO and similar through the round trip to that providerMinutes__Host-kh_rt_<app id>Keeps a web app signed in (its refresh token, out of reach of the page's scripts); partitioned, so it lives only within that app's siteThe app's sign-in lifetime, at most 400 days

The Anchr.ing site and dashboard

The site sets no cookies of its own. Signing in to the dashboard uses the sign-in cookies above on anchring.prod.anchr.ing. The dashboard keeps your access token in memory only. It stores two things in your browser's local storage:

Your language choice, when you pick one in the footer (kept until you change it).
Which environment, test or production, you last viewed in each project (removed when you sign out).

Paying for a plan, or adding a card or bank account, happens on the hosted payment page of our payment processor, Adyen, on Adyen's own domain (adyen.com), not ours. Adyen may set its own cookies there and use data about your device to prevent fraud and for 3-D Secure, under Adyen's cookie and privacy policies; your bank may show its own 3-D Secure page. We set no cookies for payments.

Analytics on the public pages

The public pages (not the dashboard and no sign-in page) load our self-hosted analytics script. It sets no cookies, but it stores a random visitor ID (rybbit-visitor-id) in local storage, with no expiry, to count repeat visits; nothing else about you is stored in your browser. See the privacy policy for what it records.