Legal · Last updated 2026-09-02 · Effective 2026-09-02
Cookie Policy
This policy explains what cookies ShieldAgent uses, why we use them, and how you can manage them. We keep our cookie footprint minimal: everything we set, on the dashboard and on this marketing site, is strictly necessary — session, security, and one language-preference cookie. We set no analytics or advertising cookies, so there is nothing here that needs a consent banner.
Strictly necessary cookies
Strictly necessary cookies
These cookies are essential for the ShieldAgent dashboard and marketing site to operate. They enable core functions such as session management, authentication, and CSRF protection. You cannot opt out of strictly necessary cookies; doing so would break the service.
| Cookie name | Purpose | Duration | Domain |
|---|---|---|---|
| sa_session | User session token for the ShieldAgent dashboard. | Session (expires on logout or browser close) | app.shieldagent.io |
| sa_csrf | Cross-site request forgery protection token. | Session | app.shieldagent.io |
| __Host-sa_refresh | Secure refresh token for maintaining authenticated sessions. | 30 days (rolling) | app.shieldagent.io |
| NEXT_LOCALE | Remembers which language (English or Spanish) to serve you. Set automatically from your browser's language on your first visit, and updated whenever you switch languages, so the site does not have to redirect and re-detect your language on every later visit. Not used for tracking. | 365 days | shieldagent.io |
Analytics measurement
How we measure traffic on this site
We use Plausible, an EU-hosted analytics tool, to understand aggregate traffic to shieldagent.io — which pages are visited and roughly where visitors come from. It sets no cookie and no persistent identifier: it does not use a device fingerprint, does not track you across sites or visits, and retains no identifier that outlives the day. Because nothing is stored on your device and no one is tracked across visits, this does not require the consent that a tracking cookie would.
The script that reports this data loads from shieldagent.io/js/script.js — our own domain, not a third party — so ad and tracker blockers that filter by third-party domain do not need to make an exception for us.
The measurement requests also use our domain: events are sent to shieldagent.io/api/event, which our server forwards to Plausible for processing. The browser does not send those events directly to plausible.io. This same-origin proxy does not add a cookie or persistent identifier.
Managing cookies
How to manage your cookie preferences
Browser settings
All major browsers let you view, block, or delete cookies through their settings. Blocking NEXT_LOCALE on shieldagent.io just means we re-detect your language on each visit — no loss of functionality. If you are signed in to the ShieldAgent dashboard (app.shieldagent.io), blocking its strictly necessary cookies will prevent the dashboard from functioning, since those cookies are what keep you signed in.
Changes to this policy
We may update this Cookie Policy when we add or remove cookies. Material changes will be notified to registered users by email. The “Last updated” date at the top of this page reflects the most recent revision.
Contact
Questions about cookies?
Privacy enquiries: privacy@shieldagent.io
Related policies: Privacy Policy · Data Processing Agreement · Terms of Service
Last updated 2026-09-02. Effective 2026-09-02. ShieldAgent.