Cookie Policy
Which cookies SPP sets, what each one is for, and how long it lasts.
In effect from 21 October 2026.
The short version
SPP sets no advertising cookies, no analytics cookies and no third-party tracking cookies. There is nothing on this site that follows you to another one, and nothing that builds a profile of you. Every cookie below is strictly necessary: it exists to sign you in and keep that sign-in safe. That is why there is no consent banner — there is nothing to consent to beyond the cookies without which the platform cannot let you in at all.
The cookies in full
| Name | What it is for | How long it lasts |
|---|---|---|
spp_session | Keeps you signed in and carries who you are, which workspace you are in and what you may do. Without it every page would ask you to sign in again. | 10 minutes from your last request |
spp_mfa | Holds a sign-in half-finished while you fetch your second-factor code, so the code can be matched to the attempt that asked for it. | 5 minutes |
spp_sso_state | A one-time value that ties a single sign-on round trip to the browser that started it, so a reply from the identity provider cannot be replayed from somewhere else. | 10 minutes |
spp_ms_state | The same one-time protection for a Microsoft 365 connection while you are away at Microsoft approving it. | 10 minutes |
spp_storage_oauth | The same one-time protection for a document-store connection — Google Drive, Dropbox, Box — while you are away at that provider approving it. | 10 minutes |
All of them are set by SPP itself, on its own domain. All are http-only, so no script can read them; all are marked secure, so they travel only over an encrypted connection; and all are same-site, so another website cannot cause your browser to send them.
What is stored in your browser besides cookies
While you work, SPP keeps a copy of the screen you are on in your browser's local storage — the rows you are editing, which panels you had collapsed, the filter you last used. That is not a cookie: it is never sent to a server, it is there so a refresh does not lose your place, and clearing your browser data removes it. The authoritative copy of your records lives in your workspace, not in the browser.
Turning them off
Every browser can block or delete cookies, and you may do so. Blocking the ones above does not reduce tracking, because none of them track anything; it stops you from being able to sign in, because the platform then has no way to remember that you did. Deleting them while signed in simply signs you out.
Changes and questions
A cookie added to SPP is added to the table above at the same time, and the date at the top changes with it. What happens to the information behind these cookies is set out in the Privacy Policy. Questions go to support@sppbynur.com.