Cookie policy

We use three authentication cookies and two local browser preferences. Cookies are sent with matching requests; local storage keeps values in your browser. We do not currently use advertising or third-party frontend analytics.

access_token — dashboard authentication, HttpOnly, path /app, normally 30 days. refresh_token — session renewal, HttpOnly, path /app/auth/refresh, normally 30 days. csrf_token — protects state-changing requests against cross-site forgery, script-readable, path /, normally 30 days. Lifetimes follow configured session settings. Cookies use SameSite=Lax and Secure in production; signing out clears them. Lax restricts but does not eliminate all cross-site delivery.

tg_login_secret binds the bot login handshake to your browser, normally for 5 minutes. tg_oidc_state binds browser-based Telegram login to its security state and PKCE verifier, normally for 30 minutes. Both are HttpOnly, SameSite=Lax and scoped to /app/auth/telegram. They use Secure when served over HTTPS. Successful login clears them; otherwise they expire. These are necessary login-security cookies, not advertising identifiers.

herascrape-theme remembers light or dark appearance. herascrape.picker-shape remembers payment-picker layout dimensions. Values remain locally until removed or overwritten and are not advertising identifiers.

Authentication and security cookies support the requested signed-in service. Preferences support the interface. Consent requirements depend on technology and applicable law. We do not currently deploy analytics, advertising pixels, session replay or cross-site trackers. Added non-essential technologies requiring consent must remain disabled until valid consent and permit withdrawal.

Cloudflare Turnstile processes device and browser security signals. Telegram login may involve storage on Telegram domains. See those providers’ notices and our privacy policy. This first-party inventory is not a guarantee that external services never set their own cookies.

You can inspect, block or delete cookies and local storage in browser settings. Blocking authentication cookies prevents normal account use; public marketing pages remain viewable. We update the inventory when technologies change.

support@herascrape.com, or @herascrape_support_bot on Telegram.