Cookie Policy

Last updated October 10, 2026

PruneSEO sets six kinds of cookie, and every one of them is required to keep you signed in or to stop someone impersonating you. There are no advertising, analytics or cross-site tracking cookies, which is why there is no consent banner to click.

1.What these are

A cookie is a small file a website asks your browser to store and send back on later requests. Most sites use them to advertise, to analyse traffic, or to follow you between sites. This one does none of those things, which is a much shorter list than you are probably expecting.

Every cookie below is strictly necessary: removing it would either sign you out, break a sign-in you are halfway through, or remove the protection that stops another site submitting commands as if they were yours.

2.The cookies we set

Every cookie this site sets

Cookie	What it does	How long
grit_access	Keeps you signed in. An HttpOnly cookie, so scripts on a page cannot read it.	Short-lived; renewed while you are active
grit_refresh	Keeps you signed in across visits without re-entering your password.	Long-lived, revoked when you sign out
grit_signed_in	A flag telling the interface you are signed in, so it does not flash a signed-out state on every page load.	Matches your session
grit_csrf	Protects against cross-site request forgery. Your browser and our server compare a matching value on anything that changes data.	Short-lived
totp_trusted	Remembers a device you have verified with two-factor authentication, so it does not ask you for a code every time.	Until you remove the device or it expires
Sign-in state cookies	Short-lived values used while connecting Google Search Console, an SSO provider or SAML. They stop a third party hijacking a sign-in in progress.	Minutes

The cookies carrying a session or an OAuth handshake are marked HttpOnly and, in production, Secure — a browser will not send them over an unencrypted connection, and page scripts cannot read their contents.

3.What we do not set

No advertising cookies. No analytics or session-recording scripts. No pixels, no tag managers, and nothing from a third-party network.

Because none of the above exist, there is no consent banner. A banner that asks permission for things a site is not doing is theatre, and the click-through rates people give it are not consent.

4.Cookies from other services

Two parts of the product sit inside other people’s sites, and those services may set their own cookies while you are there:

Google, during the Search Console sign-in flow. Connecting your property happens on Google’s own pages.
Your identity provider, if you sign in through SSO rather than with a password.

Those cookies are governed by Google’s and your provider’s own policies, not this one. We cannot describe or control them, and we do not read them.

5.Controlling cookies

Every browser lets you view and delete cookies, and block them for this site. Blocking them will sign you out and prevent sign-in from working, because the ones we set are load-bearing.

You can also clear site data from the product itself: signing out revokes your sessions on every device, and your profile lists those devices so you can end them individually.

6.If this changes

If we ever add a cookie that is not strictly necessary, this page changes first, it says what the cookie is for and who set it, and — because it would then be optional — we will ask before setting it rather than assuming the answer.