Legal
Cookie Notice
Last updated 31 August 2026
The short version. We set strictly necessary cookies, and we ask before setting anything else. Analytics cookies are set only if you accept them, and if you decline we still count the visit without storing anything on your device. There are no advertising or profiling cookies here today, and this page will change before there are.
1. What a cookie is here
A cookie is a small piece of text a site stores in your browser and reads back on the next request. The same rules cover comparable technologies such as localStorage and sessionStorage, and where we use those, we treat them the same way.
2. What we actually set
The complete list. Everything on it is strictly necessary: remove it and the feature it supports stops working.
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-…-auth-token | Keeps you signed in and identifies your access tier on each request. Set by our authentication provider. Only present once you sign in. | Until you sign out or it expires |
sb-…-auth-token-code-verifier | A short-lived value used to complete the sign-in exchange securely. It is discarded as soon as sign-in finishes. | Minutes |
| Cloudflare security cookies | Set by our network provider to tell real visitors from automated attacks and to keep the site available. They carry no advertising or profiling data. | Up to 30 days |
lwu_consent | Remembers whether you accepted or declined analytics, so you are not asked again on every page. Necessary: without it we cannot honour the answer you gave. | 1 year |
lwu_sid | A random number with no name or account attached to it, used to tell that several page views in a row came from one visit. Set only if you accept analytics. | 30 minutes |
_ga, _ga_… | Google Analytics, which tells us how many people arrive and from where. Set only if you accept analytics. Decline and the Google tag is told not to store anything, so these are never written. | Up to 2 years |
If you have never signed in and you decline analytics, the only cookie of ours left is the one recording that you declined.
3. What happens if you decline
Declining is one click and it is not a dead end for us, so there is no reason for us to make it awkward. If you decline:
- No analytics cookie is set, and no session number. Google Analytics is told, through Google's own consent signal, to store nothing.
- We still count the page view. It is added to a daily total with nothing attached to it, so we can see that a page was read without being able to tell that it was you, or link it to anything else you did.
- You can change your mind. Clearing this site's cookies in your browser brings the banner back.
4. What we still do not set
- No advertising or profiling cookies. We do not run retargeting pixels, conversion pixels or social-network trackers.
- No session recording or heatmaps. Nothing here replays your mouse movements or keystrokes.
- No selling or sharing of what we measure. The analytics exist to tell us which pages are worth improving. They are not a product.
5. Third parties
Three other companies can set a cookie in connection with this site, each only in specific circumstances:
- Google, for Analytics, and only if you accept. Data is processed by Google outside the UK and EU under their standard contractual clauses. Decline and their tag stores nothing.
- Cloudflare, which sits in front of the site to keep it fast and to absorb attacks. Its cookies are security infrastructure, not marketing.
- Lemon Squeezy, only if you go through checkout. Payment happens on their pages, under their cookie policy, and it is where their cookies are set, not here.
Who processes what, and where, is set out in full in our privacy policy.
6. If we introduce advertising
We may fund the free tier with advertising in future. We are telling you now rather than changing this page quietly later, so here is the commitment:
- This notice will be updated before any ad script goes live, not after, and the date at the top will change.
- Visitors in the UK and the EEA will be asked for consent through a proper consent interface before any advertising or measurement cookie is set, with refusing as easy as accepting.
- The advertising cookies in question would be set by the ad provider, and each would be listed here by name and purpose.
- Pro subscribers will not see ads at all, and so will not be given advertising cookies. That is not a future promise. It is already how the tier is built.
6. How to control cookies
Every browser lets you see, block and delete cookies from its settings, usually under Privacy. You can block ours specifically without affecting other sites.
The practical consequence is small and worth knowing: blocking our cookies means you cannot stay signed in, so you will see the site as an anonymous visitor. Everything public still works. If you only came to read the lists, blocking them costs you nothing.
7. Do Not Track and Global Privacy Control
There is no industry consensus on how sites should respond to a Do Not Track header, so most ignore it. The question is moot here, because we do not track you whether you send the signal or not. If we ever add advertising, we will honour Global Privacy Control signals as an opt-out.
8. Changes
The date at the top of this page changes whenever this notice does. Any change that introduces a cookie requiring consent will be accompanied by a consent request, not a silent edit.
9. Questions
listofwebsitesusing.com is operated by Shared Authority. Ask us anything about this at hello@listofwebsitesusing.com or through the contact page.
See also: About List of Websites Using · Methodology · Terms · Privacy · Cookies · Removals · Contact