Cookie policy
What gets stored on your device, which parts wait for your permission, and how to change your mind.
Last updated 29 September 2026
The short version
Nothing except what is strictly necessary is set until you say yes. Analytics and advertising are switched off when you arrive, and stay off unless you turn them on. Declining costs you nothing and the site works identically.
One thing runs before you choose: our own page counter. Until you agree to analytics it stores nothing on your device and cannot recognise you from one day to the next. It is described in our own page counter below.
Strictly necessary
These make the site function. They cannot be turned off, and under the rules they do not need consent: without them you could not stay signed in, and the sign-in form could not tell a real submission from a forged one.
| Cookie | What it does | How long |
|---|---|---|
sb-*-auth-token | Keeps you signed in | Session / until sign-out |
cookieyes-consent | Remembers your cookie choice, so we do not ask again, and so we can show we asked | 1 year |
Our session cookie is host-only: it is set for secondshadow.com alone and is not shared with any subdomain. That is a deliberate design decision, not a default.
Analytics, only if you agree
| Cookie | What it does | How long |
|---|---|---|
_ga, _ga_* | Google Analytics. Counts visitors and which pages get read | Up to 2 years |
ss_attr (was crmplify_attr) | Ours. Remembers which campaign or site brought you here the first time, so that if you later sign up we know which channel actually works. It was called crmplify_attr before we became SecondShadow; if you still have that one, we carry it across and delete the old one | 90 days |
_ss_vid (local storage) | Ours, our page counter. A random code that lets it tell a return visit from a new one. Never set if your browser sends Global Privacy Control | Until you withdraw consent, which deletes it |
ss_attr holds campaign tags, the site that referred you and the page you landed on. It holds no name, email or identifier, and we never see it unless you go on to create an account. If you do not, it expires on your device. Withdraw your analytics consent and we delete it immediately. If you later sign up, no source is recorded at all.
Our own page counter
We use SecondShadow's own web tracker on this site, the same one our customers can put on theirs. Before you make any choice it counts the page you are on: the address (with anything that looks like an email address or a token removed, and everything after the ? dropped except campaign tags), the site that sent you, and how long the page was open. Until you agree to analytics it stores nothingon your device. To group one day's page views together it uses a code made from your IP address and browser that changes every day and is not kept, so it cannot recognise you tomorrow.
If you agree to analytics in the cookie banner, it also keeps _ss_vid(listed above), so a return visit is linked to an earlier one. Withdraw that consent and it is deleted. When you submit a form that asks for your email address (the “Request access” box or the contact form), it passes the email address, and your name if the form asked for it, to our own system as an enquiry. That happens when you press the button, whatever you chose in the banner, and even if you do not finish signing up. It never reads a password, a message or anything else you type, and it never reads the sign-in form.
Everything it collects goes to SecondShadow's own system, not to anyone else. What we keep and for how long is in the privacy policy.
The demo calendar, only if you load it
The demo-booking page (behind your sign-in) can show a booking calendar hosted by Google. It does not load with the page: a button tells you it is Google's, and nothing is fetched from Google until you press it. Once you do, the embedded calendar can set Google's own cookies on your device, under Google's cookie policy rather than this one, which is exactly why we make it a choice rather than a default.
Anything you type into that calendar (your name, email and any notes) goes to Google directly; we receive the booking as a calendar event. Would rather keep Google out of it entirely? Email us instead and we'll find a slot by reply; the booking page offers that route too.
Advertising
We do not currently run any advertising cookies. If that changes, they will appear here and will be off by default like everything else.
How the choice actually works
Before you decide anything, the site tells Google's tools that analytics and advertising storage are denied. That instruction is part of the page itself, not part of the banner, so it applies even if the banner is slow, blocked or broken.
Neither Google's analytics nor our own page counter loads on pages behind a sign-in. Your account, billing and security pages send nothing at all, because the addresses of those pages can contain identifiers and we do not want them leaving the system.
Changing your mind
Open the cookie settings from the link in the footer of any page. You can withdraw consent as easily as you gave it, and it takes effect immediately.
Your browser can also block or delete cookies. If you block the strictly necessary ones, you will not be able to sign in.
More
What we do with the data once collected is in the privacy policy.