Cookie policy
What gets stored on your device, which parts wait for your permission, and how to change your mind.
Last updated 15 October 2026
The short version
Nothing except what is strictly necessary is set until you say yes. Analytics and advertising are switched off when you arrive, and stay off unless you turn them on. Declining costs you nothing and the site works identically.
That includes our own page counter: it waits for your yes like the rest of analytics, and does not run at all until then. It is described in our own page counter below.
Strictly necessary
These make the site function. They cannot be turned off, and under the rules they do not need consent: without them you could not stay signed in, and the sign-in form could not tell a real submission from a forged one.
| Cookie | What it does | How long |
|---|---|---|
sb-*-auth-token | Keeps you signed in | Session / until sign-out |
__Host-ss-www-oauth | Ties the two halves of a sign-in together when you sign in through id.secondshadow.com, so a forged sign-in cannot be slipped in between them | 10 minutes, deleted when the sign-in finishes |
ss-signup-draft, ss-signup-sent, ss-signup-invited | While you create an account: keep your name and email address on the form if something needs fixing, remember where we sent your confirmation email, and, if you were invited to a workspace, the address your invitation went to. Only sent back to the sign-up page | 5, 10 and 15 minutes, deleted once used |
ss-password-error | Shows why a new password was not accepted, after the page reloads. Only sent back to the password page | 5 minutes |
cookieyes-consent | Remembers your cookie choice, so we do not ask again, and so we can show we asked | 1 year |
Our session cookies are host-only: each is set for the one address that set it (secondshadow.com, or id.secondshadow.com where you sign in) and is not shared with any other subdomain. That is a deliberate design decision, not a default.
Kept in your browser for things you use
A few small settings are kept in your browser's own storage so the site remembers them. They never leave your device on their own, and none of them is used to track you.
| Name | What it does | How long |
|---|---|---|
ss-last-email | The email address you last signed in with on this device, so the sign-in form can fill it in for you | Until you clear your browser's storage |
ss.theme | Whether you chose the light or dark look | Until you clear your browser's storage |
ss.films.watched | Which of our films you have watched, so the button that plays one can say “Watch again” | Until you clear your browser's storage |
ss.run.best, ss.run.synced, ss.run.muted | The game: your best score while signed out, whether it has been saved to your account, and whether you muted it | Until you clear your browser's storage |
ss.mfa.enrolment (session storage) | Holds your place while you set up two-factor authentication, if the page reloads part way through | Until you close the tab |
ss.pricing.build | The plan you built on the pricing page (plan, seats, monthly or yearly, currency and any add-ons you chose), saved only when you press “Start your free trial” before signing in, so it is waiting for you after sign-up. Never your name or email | 7 days, or until you use it |
Analytics, only if you agree
| Cookie | What it does | How long |
|---|---|---|
_ga, _ga_* | Google Analytics. Counts visitors and which pages get read | Up to 2 years |
ss_attr (was crmplify_attr) | Ours. Remembers which campaign or site brought you here the first time, so that if you later sign up we know which channel actually works. It was called crmplify_attr before we became SecondShadow; if you still have that one, we carry it across and delete the old one | 90 days |
_ss_vid (local storage) | Ours, our page counter. A random code that lets it tell a return visit from a new one. Never set if your browser sends Global Privacy Control | Until you withdraw consent, which deletes it |
ss_attr holds campaign tags, the site that referred you and the page you landed on. It holds no name, email or identifier, and we never see it unless you go on to create an account. If you do not, it expires on your device. Withdraw your analytics consent and we delete it immediately. If you later sign up, no source is recorded at all.
Our own page counter
We use SecondShadow's own web tracker on this site, the same one our customers can put on theirs. It runs only if you agree to analytics in the cookie banner. Until then it does not load at all, so it counts nothing, sends nothing and stores nothing.
Once you agree, it counts the pages you visit: the address (with anything that looks like an email address or a token removed, and everything after the ? dropped except campaign tags), the site that sent you, and how long each page was open. It keeps _ss_vid (listed above), so a return visit is linked to an earlier one. When you submit a form that asks for your email address (the “Request access” box or the contact form), it passes the email address, and your name if the form asked for it, to our own system as an enquiry. It never reads a password, a message or anything else you type, and it never reads the sign-in form. Withdraw your consent and it stops, and _ss_vid is deleted.
Everything it collects goes to SecondShadow's own system, not to anyone else. What we keep and for how long is in the privacy policy.
Booking a demo sets no cookies
The demo-booking page is ours: picking a time and giving your details loads nothing from Google or anyone else, and sets no cookie. Your booking goes from our server into our demo calendar, which Google hosts for us; what happens to it is in the privacy policy.
Advertising
We do not currently run any advertising cookies. If that changes, they will appear here and will be off by default like everything else.
How the choice actually works
Before you decide anything, the site tells Google's tools that analytics and advertising storage are denied. That instruction is part of the page itself, not part of the banner, so it applies even if the banner is slow, blocked or broken.
Neither Google's analytics nor our own page counter loads on pages behind a sign-in. Your account, billing and security pages send nothing at all, because the addresses of those pages can contain identifiers and we do not want them leaving the system.
Changing your mind
Open the cookie settings from the link in the footer of any page. You can withdraw consent as easily as you gave it, and it takes effect immediately.
Your browser can also block or delete cookies. If you block the strictly necessary ones, you will not be able to sign in.
More
What we do with the data once collected is in the privacy policy.