Cookie Policy

1. What are cookies?

In plain terms: we set two first-party cookies of our own. One remembers your consent choice; the other records which campaign brought you here, and exists only if you opt in to marketing cookies. Your signed-in session and settings live in browser storage, not cookies. Analytics and advertising tags run only on our public marketing pages, are off by default in every region, and stay off until you accept them in our consent banner. Nothing non-essential runs before you choose.

Cookies are small text files that a website stores in your browser when you visit. They help the site remember information about your visit, such as a preference or a consent choice, so the experience is consistent across pages and visits.

In addition to traditional cookies, we use related technologies including local storage and session storage. Where this policy says “cookies”, it covers all of these technologies; where the difference matters, we say which one is used.

2. How we use cookies

SearchChamp uses cookies and browser storage for the following purposes:

• Consent: a first-party cookie records the choice you make in our consent banner, so we can honour it and stop asking you (section 3).
• Authentication and preferences: your signed-in session tokens and interface settings are kept in browser storage, not cookies (section 4).
• Analytics (consent-based): if you grant Analytics consent, Google Analytics 4 measures how our public marketing pages are used (section 5).
• Advertising and attribution (consent-based): if you grant Marketing consent, advertising tags measure ad conversions, and a first-party cookie records which campaign brought you to the site (sections 3 and 5).
• Abuse prevention: Google reCAPTCHA protects our free public tools, and a random device identifier in local storage limits abuse of free sign-ups (sections 4 and 6).

Analytics and advertising tags load only on our public marketing pages. The signed-in product, the sign-in and sign-up pages, and our free public tools load no analytics or advertising tags at all.

3. Cookies we set directly

We set exactly two first-party cookies of our own. Both are scoped to searchchamp.com and its subdomains, marked SameSite=Lax, and sent only over HTTPS on our deployed sites.

If you sign up while a Marketing grant is active, the attribution snapshot from sc_attr is stored with your account so we can attribute the sign-up to the campaign that led to it. When you are signed in, your consent grant or withdrawal is also recorded against your account so we hold a durable record of your choice.

4. Browser storage we use

The following is kept in your browser’s local storage and session storage. These are not cookies: they are not attached to every request your browser makes, and you can clear them at any time through your browser settings.

• Session tokens: when you sign in, AWS Cognito authentication tokens are stored in local storage under keys beginning CognitoIdentityServiceProvider. Access and identity tokens are valid for 1 hour; the refresh token keeps you signed in for up to 30 days. They are removed when you sign out. These are essential: without them you cannot stay signed in.
• Interface preferences: your appearance choice (light or dark), colour template, active workspace, and similar settings, so the app looks the way you left it.
• Sign-in handoff: session storage briefly carries state between steps of the sign-in flow and is discarded when the tab closes.
• Abuse prevention: a random device identifier with no link to your identity, used to limit abuse of free sign-ups.
• Local caches: copies of your own workspace data, kept so pages load faster.

None of this storage is used for advertising, and none of it is shared with advertising or analytics providers.

5. Consent-based analytics and advertising

On our public marketing pages we use analytics and advertising tags loaded through Google Tag Manager. The default in every region is denied. Until you make a granting choice in our consent banner, the tag container itself is not loaded and no analytics or advertising requests are made. If you grant only Analytics, only Google Analytics 4 runs; every advertising tag stays off.

The services currently in use, the consent category that controls each, and the cookies they typically set (lifetimes are controlled by each provider):

These providers act as recipients of the data their tags collect; our current list of recipients and sub-processors is maintained at /legal/sub-processors, and how we handle the underlying data is described in our Privacy Policy.

If you withdraw consent, these tags stop firing from that moment and our sc_attr cookie is deleted. Cookies a provider set before your withdrawal remain in your browser until they expire or you clear them; the browser links in section 7 explain how.

6. Third-party services

6.1 Stripe (payments)

Checkout and billing management happen on pages hosted by Stripe, on Stripe’s own domain. We do not load Stripe scripts on searchchamp.com, so Stripe sets no cookies on our pages. Cookies Stripe uses on its own payment pages are strictly necessary for secure payment processing and fraud prevention and are governed by Stripe’s Privacy Policy.

6.2 Google reCAPTCHA (free tools)

Our free public tools are protected by Google reCAPTCHA, which distinguishes people from automated abuse. reCAPTCHA is provided by Google, may set its own cookies, and processes device and usage signals, including your IP address, under Google’s Privacy Policy. We use it solely for abuse prevention, which is why it is not controlled by the consent banner.

We do not embed advertising widgets, social media plugins, or third-party video players on our pages.

7. Managing your preferences

The consent banner: analytics and advertising are off by default everywhere. In the EEA, the UK, and Switzerland the banner offers Accept all, Reject all, and a granular choice between Analytics and Marketing. Elsewhere it is a short notice; dismissing it records a denial, never a grant. If you make no choice at all, nothing non-essential loads.

Changing your mind: use the Manage cookie preferences button at the bottom of this page. It withdraws any active grant, deletes the sc_attr attribution cookie, and reopens the granular preferences so you can make a fresh choice. Your choice is stored for 180 days; after it expires, or if we change what we ask consent for, we ask again.

Browser settings: most browsers let you view, block, or delete cookies and site data:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Blocking or clearing the essential items (the consent cookie and the session tokens in local storage) will sign you out or cause the banner to reappear, but the site remains usable.

Do Not Track and Global Privacy Control: because our default is denied in every region and nothing non-essential is set without your opt-in, these browser signals do not change our behaviour; there is no tracking running for them to switch off. We do not respond to them as separate signals.

8. Changes to this policy

We may update this Cookie Policy to reflect changes in the cookies and tags we use or in applicable law. When we make material changes we will update the “Effective” date at the top of this page. If a change means we need consent for something new, your existing consent record becomes invalid and the banner asks you again before anything new is set.

9. Contact

If you have questions about our use of cookies: