Legal

Cookie Policy

Three kinds of cookie can exist on this site: the one that keeps you signed in, the ones Cloudflare uses to tell you apart from a bot, and — only if you accept them — optional analytics cookies. The first two are strictly necessary. The third is entirely your choice, and nothing is loaded until you make it.

Last updated: 19 August 2026Effective from the same dateBack to seofixagent.com

01Who sets these cookies

This policy explains the cookies and similar technologies used on seofixagent.com. It forms part of our Privacy Policy, which explains what we do with personal data more generally.

Operator of this service

Service: SEO Fix Agent — seofixagent.com
Contact: [email protected]

SEO Fix Agent is currently operated under this trading name. Registered company details will be published in this block as soon as the entity is formed; until then all legal notices should be sent to the contact address above and will be answered from it.

02The short version

Every cookie on this site is strictly necessary

We set an authentication session cookie so the app knows who you are, and Cloudflare sets security cookies so the Turnstile challenge and the bot protection work. That is the complete list.

Optional analytics cookies. We use PostHog (EU region) to see which pages and features get used. These are set only if you accept them. Decline, and the PostHog library is never downloaded and no analytics cookie is written.
No advertising cookies, ever. We do not run Google Analytics, advertising pixels or remarketing tags.
No advertising or tracking cookies. No pixels, no remarketing tags, no cross-site tracking, no data sold to anyone.
No third-party embeds that would drop cookies of their own — no embedded video players, no social widgets, no chat bubbles.
The marketing pages you can read without signing in set no cookies of ours at all.

03What cookies are

A cookie is a small text file a website asks your browser to store and send back on later requests. It lets a stateless protocol remember something between page loads — for example, that you signed in a minute ago.

Session cookies are deleted when you close your browser; persistent cookies survive until they expire or you delete them.
First-party cookies are set by the site you are visiting; third-party cookies are set by another domain. We set no third-party cookies for tracking; the only non-first-party technology here is Cloudflare, which sits in front of our own domain as our infrastructure provider.
Strictly necessary cookies are those without which a service you explicitly asked for cannot work — signing in, or being let through a security check.

04The cookies we actually set

Authentication — set by us, strictly necessary

Cookie	Purpose	Type & lifetime
`better-auth.session_token`	Holds your signed session identifier so the dashboard knows you are logged in and every API request can be scoped to your account. Without it you would be signed out on every page load.	First-party, HttpOnly, Secure, SameSite=Lax. Expires when the session expires or when you sign out.
`better-auth CSRF / state cookies`	Short-lived cookies used by the authentication layer to protect sign-in, sign-up and password-reset forms against cross-site request forgery.	First-party, HttpOnly, Secure. Session-length or a few minutes.

Over HTTPS these cookies may appear in your browser with a __Secure- prefix. They contain an opaque identifier — not your name, your email or your password.

Security and bot protection — set by Cloudflare, strictly necessary

Cloudflare serves this site and protects it from abuse, and Cloudflare Turnstile guards sign-up, sign-in and password reset. Turnstile is a privacy-preserving alternative to a reCAPTCHA-style challenge: it verifies that a human is making the request without profiling you across the web or serving you advertising.

Cookie	Purpose	Type & lifetime
`__cf_bm`	Cloudflare bot management. Distinguishes human visitors from automated traffic so abusive requests can be filtered before they reach us.	Set by Cloudflare, roughly 30 minutes.
`cf_clearance`	Records that a security challenge was passed, so you are not challenged again on every request.	Set by Cloudflare, up to 30 days.
`cf_chl_* / Turnstile state`	Very short-lived values used while a Turnstile challenge is being solved and verified on our server.	Set by Cloudflare, minutes.

Cloudflare acts as our processor for this purpose. What it collects and how long it keeps it is described in Cloudflare's own documentation; our use of it is covered in the Privacy Policy.

Payments — on Stripe's pages, not ours

When you check out or open the customer portal, you are on a page hosted by Stripe. Stripe sets its own cookies there for fraud prevention and to make checkout work. We do not control them, and they are governed by Stripe's privacy and cookie notices. Our own pages embed no Stripe tracking script.

05Other browser storage

Cookies are not the only way a site can store something in your browser, so for completeness:

We may use localStorage for small interface preferences — for instance remembering the last tool you had open. This stays on your device, is never sent to our server, and contains no identifier that could track you.
We use no fingerprinting, no tracking pixels, no web beacons, and no third-party tag manager.
Audit results and keyword lists are stored on our server against your account, not in your browser — that is what makes them available when you sign in from another device.

06Why there is no cookie banner

Under Article 5(3) of the ePrivacy Directive and the national laws implementing it, consent is required before storing information on a user's device unless the storage is strictly necessary to provide a service the user has explicitly requested.

Every cookie described in section 4 falls inside that exemption: without the session cookie you cannot stay signed in, and without the Cloudflare security cookies the sign-in form cannot verify that you are a human. Asking for consent we do not need — and offering a “reject” button that could only break the login — would be theatre.

The commitment behind that

The absence of a banner is a promise, not an oversight. If we ever add a cookie that is not strictly necessary, a proper consent mechanism ships before it does — see section 7.

07Optional analytics cookies

We use PostHog to understand which pages and features get used. It runs in PostHog's EU region, so this data does not leave the EU. Every one of the following is true today, not a future intention:

Analytics is optional and consent-gated. Until you accept, the PostHog library is never downloaded, no request is made to it, and no analytics cookie exists.
Rejecting is as easy as accepting — two buttons of equal weight, no pre-ticked boxes, no dark patterns, no “legitimate interest” toggles.
You can withdraw consent at any time from the cookie settings, and it takes effect immediately rather than on your next visit.
Declining never reduces your access to the Service. Analytics is for us, not for you.
We do not record your screen. Session recording is switched off, and anonymous visitors are not given a person profile.

The cookie itself

Cookie	Purpose	Duration
ph_<project key>_posthog	Distinguishes visitors so page views can be counted without identifying you. Set only after you accept analytics.	About 1 year

The matching entry in the Privacy Policy lists PostHog as a processor.

08Managing cookies in your browser

You are always in control of your browser. Every major browser lets you view, block and delete cookies from its privacy or site-settings panel, and every one offers a private browsing mode that discards them when the window closes.

What blocking these will do

Because our cookies are the strictly necessary kind, blocking them has practical consequences: you will not be able to sign in or stay signed in, and the Turnstile challenge on the sign-up and sign-in forms may fail to complete, locking you out of account creation and password reset. The public marketing pages will still work perfectly.

Deleting the session cookie is a valid way to sign yourself out — although the sign-out button in the app is tidier, because it also invalidates the session on our side.

09Do Not Track and Global Privacy Control

Browsers can send a DNT or Sec-GPC signal asking sites not to track the visitor. There is no agreed standard for how a site must respond to DNT, so many sites ignore it.

We honour both signals by default and by construction: we do not track anyone, so there is nothing for the signal to switch off. If we ever add optional analytics, an opted-out signal will be treated as a refusal of consent.

10Changes to this policy

We update this page whenever the set of cookies changes, and always before a new non-essential cookie is introduced. The revision date at the top reflects the current version. Material changes are announced by email to account holders at least 14 days in advance.

11Contact

Questions about cookies, Turnstile or anything else on this page go to [email protected]. If you find a cookie on this site that is not documented here, please tell us — we will either document it or remove it.