Legal information
Cookies and similar technologies
The cookies and browser data Patcharo uses on patcharo.com and app.patcharo.com, what they are for, how long they stay and why no consent is requested.
Archived version, replaced on 24 Oct 2026. Read the version in force
Version of 23 Oct 2026
On this page
1. Our approach
Patcharo uses no advertising cookies, no audience measurement and no embedded social networks. The only third-party script is the bot-detection script that Cloudflare, our hosting provider, inserts in the pages to protect the service. The only trackers present are those strictly necessary for the service you request: showing pages in your language and time zone, signing you in, securing your account and protecting the service against abusive automated access.
These trackers are exempt from consent under article 82 of the French Data Protection Act (loi n° 78-17 of 6 January 1978) and the guidelines of the CNIL, the French data protection authority; for Cloudflare's cookie, the CNIL accepts that an anti-bot solution used only to secure the site needs no consent. This is why no consent banner is shown. This page nevertheless informs you of their existence and role, as the CNIL recommends.
Should Patcharo ever add a tracker that requires consent, it would only be set after you agree, you could refuse as easily as accept and withdraw at any time, and this page would be updated beforehand.
2. Cookies of the public site (patcharo.com)
| Name | Purpose | Lifetime | When it is set |
|---|---|---|---|
| patcharo_lang | Remember the language you chose (French or English). | 365 days | When you change the language in the preferences menu. |
| patcharo_tz | Show dates and times in your device's time zone (for example Europe/Paris). It only holds the name of the time zone. | 365 days | Automatically, on the first page shown, if your device's time zone differs from the one remembered. |
| cf_clearance | Security cookie of Cloudflare, our hosting provider: it keeps the result of the check that tells browsers from bots, to protect the service against abusive automated access. Page scripts cannot read it. | 1 year (set by Cloudflare, observed on 23 October 2026) | By Cloudflare, on the first page shown, through its bot-detection script. |
To show "Open the app" rather than "Sign in", the public site asks the application whether you are signed in. Your browser then sends app.patcharo.com the cookies of that address only; the answer is limited to "signed in" or "not signed in" and the public site keeps nothing of it.
3. Cookies of the application (app.patcharo.com)
| Name | Purpose | Lifetime | When it is set |
|---|---|---|---|
| sb-…-auth-token (sometimes split into .0, .1…) | Keep your session once you are signed in (authentication). | 400 days at most, a technical lifetime set by the authentication library. The session ends much earlier: when you sign out, after 2 hours without activity or when you end the session from your settings. | When you sign in or open a confirmation link, then at each session renewal. |
| sb-…-auth-token-code-verifier and variants …-flow-…-code-verifier, …-flows-code-verifier | Technical security elements of the authentication library, created when a confirmation or reset e-mail is requested. | Until you sign out, 400 days at most. | When you create an account, ask for a new password or a new confirmation e-mail. |
| patcharo_lang | Remember the language chosen for the application. | 365 days | When you choose a language, or at sign-in to restore the choice already made on your account. |
| patcharo_tz | Show dates and times in your device's time zone. | 365 days | Automatically, as on the public site. |
| patcharo_workspace | Remember the workspace (or managed customer) you opened. | 180 days | When you switch workspace or accept an invitation. |
| __Host-patcharo_device | Remember this device for two-factor authentication: it holds a random token of which Patcharo keeps only the fingerprint. | 30 days at most after the code, then deleted; earlier if you forget the device, change your password or remove a factor. | Only if you tick "Remember this device" after entering a code (unticked by default). |
| patcharo_device_notice | Show a warning when the device could not be remembered (limit of 10 devices reached). | 5 minutes | Right after the code is entered, in that case only. |
| patcharo_pending_email | Show the (masked) address the e-mail was sent to and allow resending it, without putting it in the page address. | 15 minutes | When you create an account or ask to reset your password. |
| cf_clearance | Cloudflare security cookie, as on the public site. | 1 year (set by Cloudflare) | By Cloudflare. |
An old patcharo_locale cookie, no longer set since 30 September 2026, may remain in some browsers: it is no longer read and disappears when it expires.
4. Browser local storage and session storage
| Key | Purpose | Lifetime | When it is written |
|---|---|---|---|
| theme (local storage) | Remember the display theme you chose: light, dark or system. | Until you clear it | Only when you choose a theme. |
| patcharo:session-activity and patcharo:session-report (local storage, application) | Measure your last real activity in the application so that the session closes after 2 hours of inactivity (account security). Only times are written there. | Until you clear it | When you interact with the application. |
| patcharo.cve-explorer.address (session storage, public site) | Let you go back to the vulnerability explorer's results with your search criteria. | Until the tab is closed | When you use the vulnerability explorer. |
| __vinext_rsc_initial_reload__ and __vinext_hard_navigation_target__ (session storage) | Technical keys of the application framework that prevent a reload loop after a navigation error. | Cleared at the next load, or when the tab is closed | Only after a navigation error. |
5. Third-party services and external links
No third-party content (video, font, map, share button, analytics tool) is loaded by Patcharo's pages. Fonts are served by Patcharo itself.
Once online payment opens, payment and subscription management will take place on Stripe's pages (checkout.stripe.com, billing.stripe.com), which set their own cookies under their own responsibility. Links to vendor sites, the NVD, CISA or CERT-FR open those sites, which apply their own rules.
6. Managing or deleting these trackers
You can delete cookies and browser storage at any time from your browser's settings, or block them. As the trackers described here are necessary, blocking them may prevent signing in to the application or lose your display preferences. Deleting the cookies of app.patcharo.com signs you out on that device.
For any question about these trackers or your data, see the privacy policy or write to contact@patcharo.com.