1. What this policy covers

This policy explains the cookies and similar browser storage (local storage and session storage) used on scrupling.com, under the EU ePrivacy rules as applied in Romania (Law 506/2004) and the GDPR. It forms part of our Privacy Policy.

2. Strictly necessary cookies

These make sign-in and security work. They are set only when needed, never used for advertising, and the law does not require your consent for them. All are first-party, HTTP-only where marked, sent only over HTTPS and limited to our site.

Strictly necessary cookies
Name	Purpose	Lifetime
`scrupling_session` (HTTP-only)	Keeps you signed in; signed by our server so it cannot be forged	1 hour, renewed while you use Scrupling; removed when you sign out
`scrupling_access` (HTTP-only)	Carries your sign-in to our API so it can check your access on every request	Until the sign-in token expires, at most 24 hours
`scrupling_refresh` (HTTP-only)	Renews your sign-in without asking for your password again	30 days; removed when you sign out
`scrupling_pkce` (HTTP-only)	Protects "Continue with Google" against forged sign-ins, if offered	A few minutes, during that sign-in only
Cloudflare security cookies (for example `__cf_bm`)	Set by Cloudflare, our network provider, only when it needs to tell people from automated abuse	Up to 30 minutes

3. Storage in your browser

These keys stay in your browser. Except where stated, nothing in them is sent to us.

Browser storage
Name	Purpose	Lifetime
`scrupling_cookie_consent`	Remembers your choice in the cookie notice	Until you clear it or change your choice
`scrupling.draft.*`	Unsaved work: half-typed checks, onboarding answers and Playbook edits	Until you save, discard or sign out
`scrupling.check.account`	The account size you last typed in a check, to save you retyping it	Until you clear it
`scrupling.currency`, `scrupling.updates.seen`	Your price currency and the last product update you read	Until you clear them
`scrupling.ref`	An invite code from a link you opened, sent to us once when you create an account	30 days, or until used
`scrupling.goodbye` (session storage)	The confirmation shown after you delete your account	Until you close the tab

4. Visit counting (optional)

If you choose "Accept all", we count page visits with Plausible Analytics, an EU service that sets no cookie and stores nothing on your device. Your browser sends the visit to our own site first; we pass on only the page address with personal ids removed, the name of the site you came from, your browser type and your IP address, which Plausible uses to make a daily, salted count and never stores. Choose "Essential only" and no visit is counted. We also honour your browser's Do Not Track setting.

5. Your choice

You choose in the cookie notice the first time you visit, and you can change your mind at any time by clearing this site's data in your browser, which brings the notice back. Blocking strictly necessary cookies in your browser settings will stop sign-in from working. Questions: [email protected].