DRAFT — not approved for public service use
Version: 2026-09-18.6
Effective: 2026-09-18

# Cookie and Device-Storage Notice

This notice covers the portal at **https://frees3.backends.co.uk**, operated by Backends. Contact privacy@backends.co.uk with questions. Read it with the [Privacy Notice](/legal/privacy).

## 1. Essential portal functions

The portal uses a first-party session cookie to maintain a secure session, remember a successful sign-in and support protection against forged form submissions. It is not an advertising identifier. The configured cookie name is **S3PORTALSESSID**.

The cookie is set for the browser session. Its corresponding server record normally expires after two hours without a refresh. Some browsers restore session cookies when reopening; signing out and clearing site data provides more direct control. The cookie is HTTP-only and uses SameSite=Lax. Production HTTPS is required for secure transport. CSRF tokens are held within the session rather than being a separately advertised tracking cookie.

We rely on the strictly necessary exception for storage/access that is essential to the service you request. This is not a claim that every technology a supplier calls "security" is automatically exempt. The deployed configuration must be necessary and proportionate for its actual purpose.

## 2. Bot protection and infrastructure

Registration uses Cloudflare Turnstile. Your browser contacts Cloudflare for a security challenge. Technical/device signals and an IP address may be processed; our server also sends your IP with the token for verification. This is used to resist automated abuse, not to inspect customer objects. Cloudflare may handle device/browser signals and challenge tokens needed for its security checks. Its [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/) explains its processing, including its roles.

Turnstile's ordinary token flow does not mean every visit receives a `cf_clearance` cookie. That cookie can be issued when optional pre-clearance is enabled. Any Cloudflare gateway, WAF or other infrastructure cookie depends on the operator's actual deployment, not just the presence of the Turnstile widget.

The verified deployment inventory is **S3PORTALSESSID — essential login session — first party — up to 2 hours; s3portal_analytics_consent — optional analytics choice — first-party local storage — until cleared; Turnstile security storage as documented by Cloudflare**. It must identify any additional cookie, local-storage item or comparable device access, its provider, purpose and lifetime. The portal does not treat a supplier's label as a substitute for assessing the applicable rules.

## 3. Optional analytics

With your separate permission, the portal uses a self-hosted OpenPanel service to measure screen views, visit duration, referrers, device/browser information, approximate location, outgoing-link use and elements explicitly marked for analytics. We use this to understand and improve the portal, not for advertising. We do not identify the analytics profile with your account email or S3 credentials. Session replay is disabled.

The analytics SDK and event transmission are disabled unless you choose **Allow analytics**. Rejecting is as straightforward as accepting and does not affect registration, storage or support. No Terms/privacy acknowledgement counts as analytics consent. The remote SDK at `openpanel.dev` is not requested before consent. Analytics is also suppressed on pages whose URL contains a query string and on verification/password-reset paths so link tokens are not collected.

Your choice is saved in first-party local storage as **s3portal_analytics_consent**, with the value `granted` or `denied`, until you clear site data or change it using **Privacy choices** in the footer. If you withdraw after enabling analytics, the portal clears the SDK state and reloads without the analytics script. OpenPanel describes its analytics as cookieless, but that does not make the consent-choice storage or analytics processing invisible or automatically exempt.

Analytics events go to our configured self-hosted API at `api.openpanel.backends.co.uk`; the browser SDK is distributed by OpenPanel AB from `openpanel.dev`. Provider/location details appear in the [Provider Register](/legal/subprocessors). Event retention is **Event-level analytics retained 90 days, then deleted; aggregated reports retained 12 months**.

## 4. Your controls

You can block or delete cookies through your browser settings. Blocking essential session functionality will prevent sign-in and may prevent registration or protected forms from working. Public information remains available so far as technically possible.

The analytics choice panel is not used to imply that the essential portal session depends on consent. You can reopen it from **Privacy choices** in the footer. Our [Privacy Notice](/legal/privacy) explains wider data rights and complaints.