Document release: 2026-09-18.6 · Effective: 2026-09-18
Cookie and Device-Storage Notice
This notice covers the portal at https://frees3.backends.co.uk, operated by Backends. Contact privacy@backends.co.uk with questions. Read it with the Privacy Notice.
1. Essential portal functions
The portal uses a first-party session cookie to maintain a secure session, remember a successful sign-in and support protection against forged form submissions. It is not an advertising identifier. The configured cookie name is S3PORTALSESSID.
The cookie is set for the browser session. Its corresponding server record normally expires after two hours without a refresh. Some browsers restore session cookies when reopening; signing out and clearing site data provides more direct control. The cookie is HTTP-only and uses SameSite=Lax. Production HTTPS is required for secure transport. CSRF tokens are held within the session rather than being a separately advertised tracking cookie.
We rely on the strictly necessary exception for storage/access that is essential to the service you request. This is not a claim that every technology a supplier calls "security" is automatically exempt. The deployed configuration must be necessary and proportionate for its actual purpose.
2. Bot protection and infrastructure
Registration uses Cloudflare Turnstile. Your browser contacts Cloudflare for a security challenge. Technical/device signals and an IP address may be processed; our server also sends your IP with the token for verification. This is used to resist automated abuse, not to inspect customer objects. Cloudflare may handle device/browser signals and challenge tokens needed for its security checks. Its Turnstile Privacy Addendum explains its processing, including its roles.
Turnstile's ordinary token flow does not mean every visit receives a cf_clearance cookie. That cookie can be issued when optional pre-clearance is enabled. Any Cloudflare gateway, WAF or other infrastructure cookie depends on the operator's actual deployment, not just the presence of the Turnstile widget.
The verified deployment inventory is S3PORTALSESSID — essential login session — first party — up to 2 hours; s3portal_analytics_consent — optional analytics choice — first-party local storage — until cleared; Turnstile security storage as documented by Cloudflare. It must identify any additional cookie, local-storage item or comparable device access, its provider, purpose and lifetime. The portal does not treat a supplier's label as a substitute for assessing the applicable rules.
3. Optional analytics
With your separate permission, the portal uses a self-hosted OpenPanel service to measure screen views, visit duration, referrers, device/browser information, approximate location, outgoing-link use and elements explicitly marked for analytics. We use this to understand and improve the portal, not for advertising. We do not identify the analytics profile with your account email or S3 credentials. Session replay is disabled.
The analytics SDK and event transmission are disabled unless you choose Allow analytics. Rejecting is as straightforward as accepting and does not affect registration, storage or support. No Terms/privacy acknowledgement counts as analytics consent. The remote SDK at openpanel.dev is not requested before consent. Analytics is also suppressed on pages whose URL contains a query string and on verification/password-reset paths so link tokens are not collected.
Your choice is saved in first-party local storage as s3portal_analytics_consent, with the value granted or denied, until you clear site data or change it using Privacy choices in the footer. If you withdraw after enabling analytics, the portal clears the SDK state and reloads without the analytics script. OpenPanel describes its analytics as cookieless, but that does not make the consent-choice storage or analytics processing invisible or automatically exempt.
Analytics events go to our configured self-hosted API at api.openpanel.backends.co.uk; the browser SDK is distributed by OpenPanel AB from openpanel.dev. Provider/location details appear in the Provider Register. Event retention is Event-level analytics retained 90 days, then deleted; aggregated reports retained 12 months.
4. Your controls
You can block or delete cookies through your browser settings. Blocking essential session functionality will prevent sign-in and may prevent registration or protected forms from working. Public information remains available so far as technically possible.
The analytics choice panel is not used to imply that the essential portal session depends on consent. You can reopen it from Privacy choices in the footer. Our Privacy Notice explains wider data rights and complaints.