Legal

Cookie Policy

Version 1 · Last updated 25 October 2026

This page is a template under legal review. Items in [square brackets] are placeholders that will be completed before it is final.

ContentMas uses only cookies and browser storage that are needed for the features you use. We do not use analytics, advertising or tracking cookies, and no third-party tracking script runs on our pages. Because these items are strictly necessary for a service you asked for, the law (the ePrivacy Directive and the UK PECR) does not require consent for them; we still list every one of them here.

Cookies set by contentmas.com

NamePurposeSet whenDuration
cm_sessionKeeps you signed in. Holds a random value; we store only its hash.After you sign in with Google30 days, or until you sign out
cm_oauthProtects the Google sign-in step against forgery (state and PKCE check).When you start signing in10 minutes; deleted when sign-in finishes
cm_creatorA random value identifying this browser to our server (we store only its hash). It lets us list the site audits you ran here while signed out, and makes sure only this browser can save them to your account later. A shared report link alone is not enough.When you run a site audit while signed out12 months, or until you sign out or delete your account
cm_auditsThe private links (share tokens) of single-page audits you ran in this browser, so we can list them for you again. Sent only to our API, never readable by page scripts.When you run a single-page audit12 months, or until you sign out or delete your account

All four are first-party, HttpOnly (not readable by page scripts), SameSite=Lax and, on HTTPS, Secure. None is used to track you across sites.

Browser local storage

KeyPurposeDuration
cm_cookie_consentRemembers your choice in the cookie banner so it is not shown on every visit.12 months, then you are asked again

Third-party services

  • Google sign-in. When you choose "Continue with Google" you go to Google's own pages, where Google's cookies and privacy policy apply.
  • Google reCAPTCHA (only if enabled). Loads when you start filling in a contact or demo form, to tell people from bots. Google may set or read its own cookies for this. Google's Privacy Policy and Terms apply.
  • Google Fonts. The printable report view loads fonts from Google, which receives your IP address. No cookies are set by this.
  • Profile photo. If you are signed in, your Google profile photo loads from Google's servers.

Managing cookies

Signing out or deleting your account deletes cm_session, cm_creator and cm_audits. Audit links are no longer kept in local storage; any older list is removed automatically on your next visit. You can also delete cookies and site data in your browser settings; you will then be signed out and audits you ran while signed out can no longer be saved to an account.

Questions or requests? Use our contact form. See also the Privacy Policy, Terms, Cookie Policy, Acceptable Use Policy and Trust & compliance.