Legal
Cookie Policy
This policy lists every cookie and similar technology this site uses, what each one is for, how long it lasts, and how you control it. Tools we plan to add are described here before they arrive, and are marked as not in use until they are.
- Effective
- Last updated
- Version
- 1.6.0
1. At a glance
Analytics and marketing tools load only after you have opted in. You can change or withdraw that choice at any time from Cookie preferences, and the change takes effect straight away.
Some of the tools below are in use and some are only planned, and each one is labelled. We describe planned tools before they are switched on rather than adding them quietly later, and this page changes in the same release that switches one on.
2. What cookies are, and what else this covers
A cookie is a small text file a website places on your device. A first-party cookie is set by the site you are visiting. A third-party cookie is set by another domain, and is what makes tracking across different websites possible.
This policy also covers similar technologies — local storage, session storage and pixels — because the rules that govern them are about storing or reading information on your device, not about the word "cookie".
3. The four categories
| Category | What it is for | Your control |
|---|---|---|
| Strictly necessary | Required to sign you in, keep you signed in, and protect the forms you submit. The service cannot work without them, so they are not subject to consent. | Always on. The service cannot work without them, so there is no switch. |
| Functional | Remember a preference you have expressed, such as light or dark appearance. Not required, and nothing breaks without them. | Saved only when you choose an appearance yourself. There is no switch for it in Cookie preferences; clearing this site’s data in your browser removes it. |
| Analytics | Measure how the site is used in aggregate, so we can tell which pages are worth improving. Never loaded without your opt-in. | Off until you switch it on, from the banner or from Cookie preferences. |
| Marketing | Attribute a sign-up to the campaign that led to it. Never loaded without your opt-in. | Off until you switch it on, from the banner or from Cookie preferences. |
4. Strictly necessary cookies
Most are set by our sign-in system. None contains an advertising identifier and none is shared with anyone. Every one carries `sameSite=lax` and is marked `secure` when served over HTTPS.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| `authjs.session-token / __Secure-authjs.session-token` | Opus Rank (first-party) | Holds your signed-in session. Without it you would be signed out on every page. | 30 days |
| `authjs.csrf-token / __Host-authjs.csrf-token` | Opus Rank (first-party) | Stops another website from submitting sign-in and account forms on your behalf (cross-site request forgery protection). | Session |
| `authjs.callback-url / __Secure-authjs.callback-url` | Opus Rank (first-party) | Remembers the page to return you to after you sign in. | Session |
| `authjs.pkce.code_verifier / __Secure-authjs.pkce.code_verifier` | Opus Rank (first-party) | Secures the Google sign-in exchange. Only set if you sign in with Google. | 15 minutes |
| `authjs.state / __Secure-authjs.state` | Opus Rank (first-party) | Ties a Google sign-in response back to the request that started it. | 15 minutes |
| `authjs.nonce / __Secure-authjs.nonce` | Opus Rank (first-party) | Prevents replay of a Google sign-in token. Only set if you sign in with Google. | Session |
| `opusrank.password-reset` | Opus Rank (first-party) | Holds the one-time code from a password-reset link you clicked, so you can choose a new password without the code appearing in the page address. Set only when you follow such a link, sent only to the reset page, and deleted once used. | 60 minutes, or until used |
| `opusrank.locale` | Opus Rank (first-party) | Remembers the language you chose from the language selector, so returning to the site takes you to it. Set only when you pick a language yourself — we never guess it from your browser settings. It holds a language code and nothing else. | 1 year |
| `opusrank.workspace` | Opus Rank (first-party) | Remembers which of your workspaces you were last looking at, if you belong to more than one. It is a preference and not a permission: access is checked against your account on the server every time. | 30 days |
| `opusrank.consent` | Opus Rank (first-party) | Remembers which categories of optional cookies you agreed to, so you are not asked again on every page. It holds your choices and the date you made them, and nothing else — no identifier, and nothing about you. | 6 months |
The `pkce`, `state` and `nonce` cookies are set only if you sign in with Google, for the moments that exchange takes. "Session" means the cookie is deleted when you close your browser.
All of them are `httpOnly` — unreadable to scripts in your browser — except `opusrank.locale` and `opusrank.consent`, which the page reads to show your language and to know which optional tools it may load. Neither grants access to anything: one holds a language code, the other your cookie choices and when you made them. `opusrank.workspace` names a workspace, and your membership of it is checked on the server on every request, so editing it by hand gets you an error, never someone else’s data.
The language and workspace cookies are set only at the moment you make that choice — picking a language from the selector, or switching workspace. We never guess your language from your browser’s settings and store the result. Because each one only records a choice you have just made, neither sits behind a consent switch.
You can block any of these in your browser, but without the sign-in cookies you will not be able to sign in.
5. Functional storage
| Item | Type | Purpose | Expires |
|---|---|---|---|
| `theme` | Local storage | Remembers whether you chose light, dark or system appearance. | Until you clear site data |
Your browser reads it to decide which colours to show. It is never sent to us and cannot identify you. It has no switch in Cookie preferences because it is saved only when you choose an appearance yourself; to remove it, clear this site’s data in your browser.
6. Analytics
These tools run only on our public marketing pages and on the sign-in and sign-up pages, to understand which pages people find useful and where sign-up goes wrong. They are not loaded inside the signed-in application at all, so they cannot see what you write.
Ahrefs Web Analytics — provided by Ahrefs Pte. Ltd.. Not currently in use. Aggregate page-view and traffic-source counts for the public marketing pages. Cookieless. It sets no cookies and stores nothing on your device, and it does not track you across other websites. Privacy information: https://ahrefs.com/privacy.
This tool sets no cookies. It is listed anyway, because consent covers any collection of this kind, not only collection that uses cookies.
Google Tag Manager — provided by Google LLC. Currently in use. Loads and manages the measurement tags below. It is a container, not a measurement tool in its own right. Sets no cookies itself. What it loads does, and each of those is listed separately here. Privacy information: https://policies.google.com/privacy.
This tool sets no cookies. It is listed anyway, because consent covers any collection of this kind, not only collection that uses cookies.
Google Analytics 4 — provided by Google LLC. Currently in use. Aggregate reporting on which pages are visited, how visitors arrive, and where sign-up flows are abandoned. Advertising personalisation is always set to denied. We keep Google Signals switched off, and Google states that GA4 does not log or store IP addresses. Privacy information: https://policies.google.com/privacy.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| `_ga` | Opus Rank (first-party) | Distinguishes one browser from another so repeat visits are not double-counted. | 2 years |
| `_ga_<measurement-id>` | Opus Rank (first-party) | Holds the session state for this specific property. | 2 years |
Microsoft Clarity — provided by Microsoft Corporation. Not currently in use. Heatmaps and session replay, to show where a page is confusing rather than merely unpopular. Records session replays, so text input and page content will be masked before a recording leaves the browser. MUID is shared with other Microsoft services, which is why it is listed even though we would not use it for advertising. Privacy information: https://privacy.microsoft.com/privacystatement.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| `_clck` | Opus Rank (first-party) | Persists a Clarity identifier for this browser so repeat visits join up. | 1 year |
| `_clsk` | Opus Rank (first-party) | Joins the page views within a single visit into one session recording. | 1 day |
| `CLID` | clarity.ms | Identifies which Clarity project first saw this browser. | 1 year |
| `ANONCHK` | c.clarity.ms | Records whether the identifier may be used for advertising; we do not use it for that. | 10 minutes |
| `MUID` | clarity.ms / bing.com | Microsoft's cross-site browser identifier, shared with Bing. | 390 days |
| `SM` | c.clarity.ms | Synchronises the MUID identifier across Microsoft domains. | Session |
Microsoft Clarity can record a replay of what a visitor did on a page. Before we switch it on, we will configure it to mask text input and page content, and keep it off the pages where you write. We state this here so that it is a commitment, not just a setting.
7. Marketing
Google Ads conversion linker — provided by Google LLC. Currently in use. Attributes a sign-up to the advertisement that led to it, so campaign spend can be measured. It runs inside Google Tag Manager and is set to write its cookie only if you have allowed both analytics and marketing. That cookie is often attributed to Tag Manager itself; it is in fact set by this tag. Privacy information: https://policies.google.com/privacy.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| `_gcl_au` | Opus Rank (first-party) | Stores the ad click that preceded a visit so a later sign-up can be attributed to it. | 90 days |
8. Your choices
These rules apply to every visitor, wherever you are — not only where a particular law requires them.
- Opt-in, not opt-out. No analytics or marketing tool loads, and none of their cookies is set, until you agree. Continuing to browse is not agreement, and neither is scrolling past the banner.
- Granular. Analytics and marketing each have their own switch.
- Refusing is as easy as accepting. "Reject all" sits beside "Accept all" at the same size, and no switch is turned on in advance.
- Withdrawable at any time, from the Cookie preferences link in the footer of our public pages, or from the control at the end of this page.
- Changes take effect at once. Switching a category off, or withdrawing altogether, reloads the page without those tools and deletes the cookies we can reach.
- Refusing costs you nothing. Every part of the service works the same whether you agree or not.
- Global Privacy Control is honoured. If your browser sends a GPC signal, we treat it as a refusal and do not ask you again.
The banner appears on your first visit. After that, Cookie preferences opens the same choices, so changing your mind never depends on finding the banner again.
Some cookies are set on another company’s domain, and every row in the tables above names the domain that sets it. We cannot delete those from our site; you can remove them in your browser, as the next section explains.
9. Controlling cookies in your browser
Whatever you choose here, your browser lets you see the cookies a site has set, delete them, block them, and clear them automatically when you close it. The settings are usually under Privacy or Site Settings.
Instructions for the major browsers:
Blocking all cookies stops you signing in, because the session cookie is what keeps you signed in. Blocking only third-party cookies does not affect your account.
Some of the tools described above also offer their own opt-out:
- Google Analytics 4 — https://tools.google.com/dlpage/gaoptout
- Microsoft Clarity — https://privacy.microsoft.com/privacystatement
10. Changes and contact
We review this policy whenever we change what the site loads, and the version and dates at the top always describe the current text. If a change introduces something that needs your consent, this page is updated in the same release that switches it on, and nothing new loads until you have agreed to it.
Questions about this policy, or about anything in your browser that is not listed here, go to [email protected]. If a cookie is missing from these tables we want to know, because an inventory is only useful if it is complete.
How cookie data relates to everything else we hold about you is covered in our Privacy Policy.
Change or withdraw your choices
Open Cookie preferences to switch analytics or marketing on or off, or to withdraw consent altogether. Switching something off takes effect at once: the page reloads without it, and the cookies we can reach are deleted.