Legal
Cookie statement
The cookies the live site sets, and why each one is needed to run SortProof.
Last updated 22 October 2026.
Cookies we set
SortProof sets cookies so you can stay signed in, resume the free checker, and open the right organisation. They are strictly necessary for the service you ask for. The live site does not set an analytics cookie or a marketing cookie, so it does not show a consent banner. If that changes, this statement will be updated first and a consent control will be added.
| Cookie | What it is for | How long | Flags |
|---|---|---|---|
| __Secure-rr.session_token | Keeps you signed in. | 30 days, or until you sign out | HttpOnly, Secure, SameSite=Lax |
| __Secure-rr.session_data | A short copy of the session, so every page does not have to look it up again. | 5 minutes | HttpOnly, Secure, SameSite=Lax |
| __Secure-rr.two_factor | Holds the sign-in while you enter an authenticator or recovery code. | 30 minutes | HttpOnly, Secure, SameSite=Lax |
| __Secure-rr.trust_device | Set only if you tick “Trust this browser for 30 days” after the authenticator check. | 30 days | HttpOnly, Secure, SameSite=Lax |
| rr_active_organisation_id | Remembers which organisation is open. | 30 days | HttpOnly, SameSite=Lax |
| rr_checker_state | Remembers free-checker answers when JavaScript is unavailable. | 2 hours | HttpOnly, Secure, SameSite=Lax |
| rr_checker_from | Remembers a checker result while you create an account from that result. | 14 days | HttpOnly, SameSite=Lax |
| rr_support_session_id | Set only while a time-boxed support visit to an organisation is open. | 60 minutes | HttpOnly, Secure, SameSite=Lax |
On the live site the sign-in cookies use the __Secure- prefix. A local site served over plain HTTP uses the same names without that prefix, for example rr.session_token. Mutating requests are also checked against the site’s origin. That check does not add a further cookie.
Counts without a cookie
We count how the public site is used without an analytics cookie and without a third-party tracker. A daily salt turns the network address into a key that changes the next day. The count leaves out the network address, the browser, and any account id. Counts under 10 are shown as “<10”.
Cloudflare Turnstile
Sign-in, sign-up, password reset, and the public contact form load Cloudflare Turnstile so automated abuse can be blocked. The check runs in a Cloudflare frame. It is not used for advertising. If that check stores a cookie, the cookie is used only to complete the check.
Managing cookies
You can clear cookies in the browser. Signing out ends the session cookie. Blocking every cookie stops sign-in and can stop the checker from resuming.
Questions about cookies can go to GBK Solutions Ltd, 20 Bouverie Court, Leeds, LS9 8LB, or the contact form. The privacy notice explains the personal information those cookies support.