Cookie Policy

A cookie is a small text file that a website stores on your device to make the site work, remember your choices, or understand how the site is used. We also use similar technologies — such as browser local storage, pixels, and software development kits ("SDKs") in our mobile apps — that store or read information on your device. In this policy we refer to all of these as "cookies."

Cookies may be first-party (set by Scorecrypt) or third-party (set by one of the service providers listed on our Sub-processors page). They may last only for your current visit (session cookies) or persist across visits until they expire or you delete them (persistent cookies).

Scorecrypt sets up to three cookies, and only one of them can be set without you choosing it. The first records your answer about the second. The second is set on our marketing site only if you agree to it. The third is set only when you sign in to our web application at app.scorecrypt.com.

If you agree to it, we share the value of sc_anon_id with Statsig, the provider we use to run feature flags and experiments, so that you see a consistent version of the site. If you do not agree, there is no identifier to share and nothing is sent to Statsig at all. Statsig is listed on our Sub-processors page.

We do not set analytics or advertising cookies, and we do not allow third-party advertising trackers on our site.

Our authentication cookie is strictly necessary. It is what keeps you signed in, and there is no version of signing in that does not use it. It is set only on app.scorecrypt.com, never on our marketing site, and it is scoped so that it is not sent to any other part of scorecrypt.com.

It is marked HttpOnly, so scripts running in your browser cannot read it, and Secure, so it is only ever sent over an encrypted connection. Signing out deletes it.

We use Supabase to operate authentication for us. Supabase is listed on our Sub-processors page.

2.1 Where sc_anon_id applies.

sc_anon_id applies to scorecrypt.com and its subdomains. A visit to our marketing site and a visit to our web application at app.scorecrypt.com are connected to each other, because the cookie set on one is sent to the other, so that a visit which begins on the marketing site and continues into the application is counted once rather than twice. It stays a first-party cookie holding the same random identifier, and blocking it remains as described in Section 3. If you withdraw your agreement we remove it from both.

2.2 Email open and click tracking.

Emails can carry the same kinds of technology as a web page. We do not currently use any of it. Transactional messages — signing in, consent requests, billing, and safety notices — will never carry open or click tracking, because knowing whether you opened a safety notice is not a measurement we have any business taking.

If we introduce it for newsletters and other marketing messages, those messages will contain a small invisible image that records that the message was opened, and their links will be rewritten through our own tracking host, track.news.scorecrypt.com, so that we can see which links were clicked. That host is ours; it is not an advertising network. We would use what it records only to measure how our own mailings perform, and unsubscribing stops it. None of this uses a cookie, so blocking cookies does not affect it — the unsubscribe link is the control.

The first time you visit our marketing site we ask whether we may set sc_anon_id. Until you answer, we do not set it. Declining is one click, in the same place and the same size as accepting, and nothing about the site stops working if you decline — you simply see the standard version of every page rather than a variation we are testing.

You can change your answer at any time, in either direction, using the Cookie settings control at the bottom of any page. Withdrawing does not merely stop future use: we delete the identifier at the same moment, so nothing carries over from the period when you had agreed.

You can also block or delete cookies through your browser settings. Every major browser lets you refuse cookies, delete existing ones, or be warned before one is set. If you block sc_anon_id, the site will still work, though your experience may be less consistent between visits.

The authentication cookie is different: if you block or delete it, you will be signed out and will not be able to sign back in. It is not optional in the way sc_anon_id is.

3.1 Global Privacy Control.

If your browser sends a Global Privacy Control signal, we treat it as a refusal. We do not set sc_anon_id, we delete it if it is already there, and we do not show you the banner — you have already answered, and asking again would be asking you to repeat yourself.

We honour the signal for as long as your browser sends it, and we do not record a separate refusal of our own alongside it. If you turn Global Privacy Control off later, we will ask you the question then, rather than leaving you refused by a choice you never made.

One consequence is worth stating plainly: while the signal is on, it overrides an acceptance. If you have Global Privacy Control switched on and you press Accept, we will not set the cookie, because a standing signal from your browser is the more recent and more deliberate instruction. Turn the signal off if you want the cookie.

Separately, these signals are also designed to opt you out of the sale or sharing of personal information for advertising. We do neither, so there is nothing further for them to act on.

3.2 In our mobile apps.

Our apps use only the storage and SDKs needed to operate the app. We do not use advertising SDKs or cross-app tracking.

We do not use advertising or cross-context behavioral tracking cookies, we do not sell personal information, and we do not share it for targeted advertising. We do not allow third-party advertising networks to place trackers in the Services.

Consistent with our Children's Privacy Notice, we do not use cookies to build advertising profiles of anyone, and we do not permit our providers to use minors' information for advertising. We work to minimize the information about minors that flows to analytics and experimentation providers.

We may update this Cookie Policy from time to time. The "Last updated" date above shows when it was last revised. If we make a material change, we will provide reasonable notice (for example, through an on-site notice).

Questions about our use of cookies? Contact us at privacy@scorecrypt.com.