Cookie policy
What gets stored on your device, which parts wait for your permission, and how to change your mind.
Last updated 17 August 2026
The short version
Nothing except what is strictly necessary is set until you say yes. Analytics and advertising are switched off when you arrive, and stay off unless you turn them on. Declining costs you nothing and the site works identically.
Strictly necessary
These make the site function. They cannot be turned off, and under the rules they do not need consent: without them you could not stay signed in, and the sign-in form could not tell a real submission from a forged one.
| Cookie | What it does | How long |
|---|---|---|
sb-*-auth-token | Keeps you signed in | Session / until sign-out |
cookieyes-consent | Remembers your cookie choice, so we do not ask again, and so we can show we asked | 1 year |
Our session cookie is host-only: it is set for secondshadow.com alone and is not shared with any subdomain. That is a deliberate design decision, not a default.
Analytics, only if you agree
| Cookie | What it does | How long |
|---|---|---|
_ga, _ga_* | Google Analytics. Counts visitors and which pages get read | Up to 2 years |
ss_attr (was crmplify_attr) | Ours. Remembers which campaign or site brought you here the first time, so that if you later sign up we know which channel actually works. It was called crmplify_attr before we became SecondShadow; if you still have that one, we carry it across and delete the old one | 90 days |
ss_attr holds campaign tags, the site that referred you and the page you landed on. It holds no name, email or identifier, and we never see it unless you go on to create an account. If you do not, it expires on your device. Withdraw your analytics consent and we delete it immediately. If you later sign up, no source is recorded at all.
The demo calendar, only if you load it
The demo-booking page (behind your sign-in) can show a booking calendar hosted by Google. It does not load with the page: a button tells you it is Google's, and nothing is fetched from Google until you press it. Once you do, the embedded calendar can set Google's own cookies on your device, under Google's cookie policy rather than this one, which is exactly why we make it a choice rather than a default.
Anything you type into that calendar (your name, email and any notes) goes to Google directly; we receive the booking as a calendar event. Would rather keep Google out of it entirely? Email us instead and we'll find a slot by reply; the booking page offers that route too.
Advertising
We do not currently run any advertising cookies. If that changes, they will appear here and will be off by default like everything else.
How the choice actually works
Before you decide anything, the site tells Google's tools that analytics and advertising storage are denied. That instruction is part of the page itself, not part of the banner, so it applies even if the banner is slow, blocked or broken.
Nothing is measured on pages behind a sign-in. Your account, billing and security pages load no analytics at all, because the addresses of those pages can contain identifiers and we do not want them leaving the system.
Changing your mind
Open the cookie settings from the link in the footer of any page. You can withdraw consent as easily as you gave it, and it takes effect immediately.
Your browser can also block or delete cookies. If you block the strictly necessary ones, you will not be able to sign in.
More
What we do with the data once collected is in the privacy policy.