Legal · Cookies & storage
Cookie Policy
Last updated: 10 August 2026
This document is a good-faith template prepared to describe Seeking Data Labs' current practices. It is not legal advice and should be reviewed by qualified Swiss and EU data-protection and commercial counsel before it is relied upon.
This policy explains the cookies and browser-storage items thatseekingdatalabs.com uses. It supplements our Privacy Policy.
Summary: almost everything we set isstrictly-necessary or functional, required to log you in, keep the site working, and remember your preferences, and we useno advertising cookies and no third-party tracking. Our fonts are self-hosted (your browser makes no request to Google Fonts). We also use one optional, consent-gated analytics tool (Google Analytics 4): it loads only after you opt inthrough the consent banner. Because of it, a banner is presented and the"Cookie settings" control in the footer lets you accept, reject, or withdraw at any time, and no analytics cookie or Google request is made until you opt in.
This document is provided in good faith for transparency; it is not legal advice, and you should have it reviewed by qualified counsel before relying on it.
1. Cookies
A cookie is a small file a site or its service providers store in your browser. The session cookies below (seekingdata_session, seekingdata_oauth_state) are set by our API host (api.seekingdatalabs.com /api.seekingdata.dev), are first-party, and areHttpOnly, Secure, and SameSite=Lax, meaning page scripts cannot read them and they are not sent cross-site. Theconsent cookie (sdl_consent) is different: our own website's client-side JavaScript sets it, so it is notHttpOnly and page scripts can read it (by design, so the site can honour your choice). Cloudflare may also set the strictly-necessary security cookies noted below at the edge.
| Cookie | Category | Purpose | Lifetime |
|---|---|---|---|
seekingdata_session | Strictly necessary | Holds your signed login session so the dashboard can authenticate you. Set when you log in; cleared when you log out. | 24 hours |
seekingdata_oauth_state | Strictly necessary | A CSRF-protection token used only during Google sign-in; retired as soon as sign-in completes. | 10 minutes |
sdl_consent | Strictly necessary / functional | Records your analytics consent choice (and its version) so we honour it and do not re-ask unnecessarily. First-party, set by this website's client-side JavaScript; SameSite=Lax, Secure, Path=/, and, unlike the API-host cookies, not HttpOnly, so page scripts can read it. | ~180 days |
__cf_bm, cf_clearance (may be set by Cloudflare) | Strictly necessary (security) | Set by our CDN/WAF provider Cloudflare for bot-management and challenge validation to protect the service. Not set by our code. | ~30 min / session |
_ga, _ga_<container> | Analytics (consent-gated) | Set by Google Analytics 4 (measurement ID G-ZEB574XLZR) to measure site usage, but only after you opt in via the banner. First-party; none are set before consent, and they are cleared if you withdraw. | ~13 months |
2. Browser storage (localStorage)
We also use a few localStorage keys. These stay in your browser, are not cookies, and are not transmitted to third parties.
| Key | Category | Purpose | Lifetime |
|---|---|---|---|
seekingdata-theme | Functional | Remembers your light/dark theme choice so the page paints correctly. No personal data. | Until you clear it |
seekingdata-token | Strictly necessary | Stores your login JWT bearer token so browser code can send Authorization: Bearer on API calls and show logged-in state without a round-trip. This is a usable API credential that page scripts can read, not merely a display hint. It is sent only to our own API host, never to third parties; the HttpOnly session cookie remains the primary auth boundary. | Until logout |
sd:dashboard-draft (per user) | Functional | Auto-saves an in-progress dashboard you are building so it survives a page reload. Your content only; stays in your browser. | Until submitted/cleared |
We use no sessionStorage. The only cookie our website's own JavaScript writes via document.cookie is thesdl_consent record above; every other cookie is set by the API host or by Cloudflare. There are no third-party advertising embeds, no CAPTCHA, and no client-side payment widgets on the site.
3. Third parties
Two third parties can process data when you use the site:Cloudflare (our CDN, WAF, DNS, and website host, it processes request metadata and may set the strictly-necessary security cookies above) and Google, both when you click "Continue with Google" (which takes you to Google's own sign-in, governed by Google's privacy policy) and, if you opt in, as our analytics provider (Google Analytics 4, with data shared with Google LLC in the United States). See the Privacy Policy for the full list of processors and the international-transfer safeguards.
4. Managing your choices
- Cookie settings. Use the "Cookie settings"control in the site footer to review and change your analytics choice at any time. Turning analytics off there stops us loading Google Analytics and clears its cookies.
- Withdrawing consent is as easy as giving it, and takes effect going forward.
- Your browser. You can block or delete cookies in your browser settings, but blocking strictly-necessary cookies will stop you from logging in and using the account features.
Strictly-necessary cookies (the session cookie, the OAuth CSRF cookie, and the consent record) are set without consent because the service cannot function without them; they are described here for transparency rather than offered as an on/off choice.
5. Changes
If we add, change, or remove cookies, for example if we change our consent-gated analytics, we will update this policy and, where required, re-request your consent. The "last updated" date above reflects the current version.
Questions? Email[email protected].