Cookies

The short version

GetValuated sets one cookie. It is the cookie that keeps you signed in. There is nothing else - no analytics, no advertising, no tracking, and no third-party script collecting anything about you from these pages.

That is why you have never seen a consent banner here. There is nothing to consent to: the one cookie is strictly necessary to provide a service you asked for by signing in, and the law exempts it from consent. If that ever changes, we will ask you before setting anything new.

The cookie we set

Name

gv_session

Purpose

It carries the token that identifies your signed-in session. Without it, every page would ask you to sign in again.

How long it lasts

If you ticked "keep me signed in", 30 days. If you did not, it is a session cookie - your browser discards it when you close it, and the session behind it expires after 12 hours in any case.

Who set it

Us. It is a first-party cookie and it is not readable by anyone else.

What is in it

A random 32-byte token, and nothing more. It holds no name, no email address, and nothing about you or your company. Our own records store only a SHA-256 hash of the token, so they hold nothing that could be used to sign in as you.

How it is protected

It is HttpOnly, so page scripts cannot read it; SameSite=Lax, so another site cannot cause it to be sent; and Secure in production, so it travels only over HTTPS.

Signing out deletes the cookie and the session behind it. Changing your password ends every other session on your account.

What we do not use

To be explicit, the platform does not use any of the following:

• analytics or product-measurement cookies, of ours or anyone else's;
• advertising, retargeting or conversion cookies, and no advertising pixels;
• social media buttons or embeds that set cookies;
• cross-site or cross-device tracking, and no device fingerprinting;
• browser storage of any other kind for tracking - no localStorage, no sessionStorage, and no web beacons in our emails.

We do not sell or share anything about your browsing, because we do not collect anything about it.

What our servers record anyway

Separately from cookies, our hosting provider keeps standard server logs of requests - including IP addresses - to keep the platform running and secure. That is ordinary infrastructure logging, not tracking, and it is covered in the Privacy Policy.

Controlling cookies

Every browser lets you view, block and delete cookies, usually under Settings → Privacy. You can delete gv_session at any time - it has the same effect as signing out.

Blocking it altogether will stop you signing in. There is no way around that: the cookie is how the platform knows a request is yours, so a browser that refuses it cannot hold a session. The only pages that work without it are the sign-in and sign-up screens and the public certificate verifier.

Changes to this notice

If we add a cookie, this notice changes before it is set, and anything that is not strictly necessary will ask for your consent first. The version in force is always the one at this address, with the date it took effect at the top. Questions go to legal@getvaluated.com.