In short
- We set one cookie, and only during a passkey sign-in. It lasts ten minutes.
- Our network provider sets a small number of security cookies to keep bots and attacks off the site.
- The application stores a few items in your browser's local storage to keep you signed in and remember your preferences. That data never leaves your device except as your sign-in token, which authenticates you to our server.
- There is no advertising, analytics, profiling or cross-site tracking, and no third-party script or font is loaded at all.
Cookies and browser storage
A cookie is a small file a website asks your browser to keep and send back on later requests. Local storage and session storage do a similar job but stay on your device unless the page itself sends them somewhere.
The law that applies here — the Privacy and Electronic Communications Regulations, read with the UK GDPR — treats all of these the same way, so this policy lists all of them rather than only the ones technically called cookies.
Cookies we set
| Name | Purpose | Category | Expires |
|---|---|---|---|
ether.oidc |
Set only when you start a passkey sign-in. It holds an encrypted, signed record of
the sign-in attempt so we can verify that the response coming back from the identity
provider belongs to the request you started — the standard defence against a
login-CSRF attack. It is HttpOnly, SameSite=Lax, sent only
over HTTPS, and scoped to /api/auth/etherlogin.
|
Strictly necessary | 10 minutes, and deleted as soon as the sign-in completes |
That is the whole list. If you never use passkey sign-in, we set no cookies of our own at all.
Cookies our network provider sets
The site sits behind a content-delivery and DDoS-protection provider, which is what keeps a small remote-access service reachable under attack. It sets its own security cookies:
| Name | Purpose | Category | Expires |
|---|---|---|---|
__cf_bm |
Distinguishes a person from an automated client so bot traffic can be filtered before it reaches us. It does not store anything that identifies you personally and is not used for advertising. | Strictly necessary | About 30 minutes |
cf_clearance |
Set only if you are shown a security challenge, to record that you passed it so you are not asked again on every page. | Strictly necessary | Up to 1 year |
These are set by the provider, on our instruction, purely to protect the service. Exact names and lifetimes are the provider's to define and can change; if you see one here that this table does not explain, tell us and we will document or remove it.
Browser storage the app uses
None of these are cookies — they are not attached to requests automatically. They stay in your browser until they expire or you clear them.
| Key | Where | Purpose | Expires |
|---|---|---|---|
ether.token |
Local or session storage | The signed token that keeps you signed in. It is sent to our API to authenticate each request. If you ticked remember me it goes in local storage; otherwise in session storage, which the browser drops when you close the tab. | Up to 28 days, or until the tab closes |
ether.user |
Local or session storage | Your display name, email and role, so the interface can render without an extra round trip on every load. | Same as the token |
er-theme |
Local storage | Which colour theme you chose with the toggle, so a dark-mode visitor is not flashed a white page on the next visit. Written only when you actually use the toggle. | Until you clear it |
er-cookie-notice |
Local storage | Records that you dismissed the notice at the bottom of the page, so it is not shown again. Storing this is the only way to avoid nagging you on every visit. | Until you clear it |
ether.viewer.cursorStyle |
Local storage | The mouse-cursor style you picked in the session viewer. | Until you clear it |
What we do not use
Stated plainly, because "we value your privacy" banners usually mean the opposite:
- no advertising or retargeting cookies, and no advertising network;
- no analytics — no Google Analytics, no tag manager, no page-view or heat-map product;
- no social-media pixels, share widgets or embedded players;
- no device fingerprinting, and no cross-site or cross-device profiling;
- no third-party fonts or scripts of any kind. A page that sells "nothing leaves your infrastructure" should not phone a stranger the moment it loads, so the site loads only files served from this domain;
- no sale or sharing of any of this data. There is nothing to sell.
Why there is no consent wall
Consent is required for storage that is not strictly necessary. Everything listed above is either strictly necessary to deliver something you asked for — signing you in, keeping the site up under attack — or a preference you set yourself by clicking a control. Nothing here tracks you, so there is nothing for you to opt out of and no legitimate reason to hold the page hostage behind a dialog.
You will see a short notice at the bottom of the page on your first visit. It informs; it
does not ask, because we would not act differently on your answer. Dismissing it stores
er-cookie-notice so it stays dismissed.
If that ever changes — if we add analytics, for example — we will ask for your consent beforehand, through a proper opt-in with a genuine reject option, and update this page first.
Managing and deleting them
You are in control of all of it:
- Clear or block everything for this site. Every browser can do this per site. In Chrome and Edge it is under Settings → Privacy and security → Third-party cookies / Site settings; in Firefox under Settings → Privacy & Security; in Safari under Settings → Privacy → Manage Website Data. Look for "cookies and site data" — that covers local storage too.
- Use a private window. Nothing survives once you close it.
-
Sign out. That removes
ether.tokenandether.userimmediately.
If you block storage for this site, the marketing pages still work and still respect your
operating system's dark-mode setting — you just lose the ability to override it. The
application itself cannot keep you signed in without ether.token, so you would
be signed out on every page load.
Do Not Track and Global Privacy Control
We do not track you, so a Do Not Track or Global Privacy Control signal changes nothing about what we do. Sending one costs you nothing here, and we treat it as confirmation of a position we already hold.
Self-hosted deployments
If you run your own gateway, the application storage above (ether.token,
ether.user, ether.viewer.cursorStyle and the theme key) belongs to
your deployment on your domain, not to us — we never see it. The provider cookies in section
4 depend on whatever network layer you put in front of your own server. Your organisation
is responsible for its own cookie notice; you are welcome to adapt this one.
Changes to this policy
This list is meant to stay complete. When we add or remove something that touches your browser we update the table and the date at the top, and we do it before the change ships.
Contact
Questions about this policy, or something you found in your browser that this page does not explain:
ETHERNECO LTDThe Accountancy Partnership
70 Grange Road East
Wirral, United Kingdom, CH41 5FE
[email protected]
See also the Privacy Policy for how we handle personal data more broadly, and the Terms of Service.