Cookie Policy
Last updated: August 18, 2026
This Cookie Policy explains how Alpha CISO Pte. Ltd. ("we", "us", "our") and the operators of Extension Auditor (extensionauditor.com) use cookies, local storage, pixels, and similar tracking technologies (collectively, "Cookies") on the Service.
This policy supplements Our Privacy Policy and should be read together with it.
What are cookies?
Cookies are small text files placed on Your device when You visit a website. Modern browsers also support related local-storage mechanisms (such as localStorage and sessionStorage) that serve similar purposes. Throughout this policy, "Cookies" refers to all of these technologies.
Cookies can be:
- First-party, placed by the website You are visiting (extensionauditor.com), or
- Third-party, placed by a service provider whose technology runs on Our website.
They can also be:
- Session cookies, which are deleted when You close Your browser, or
- Persistent cookies, which remain on Your device until they expire or You delete them.
Categories of cookies and similar technologies we use
We classify the technologies on Our Service into four categories. The first two are loaded automatically as essential to the Service. The other two are loaded only after You give consent via Our cookie banner.
1. Strictly necessary (always on)
These technologies are required for the Service to function. Without them, the Service cannot be provided. They do not require consent under the EU ePrivacy Directive or comparable laws because they are necessary to deliver a service explicitly requested by You.
| Technology | Provider | Purpose | Type |
|---|---|---|---|
| Authentication session cookie | Self-hosted (Hetzner) | Keeps You signed in across pages | First-party, session |
| CSRF / security token | Self-hosted (Hetzner) | Prevents cross-site request forgery | First-party, session |
Cookie-consent status (cookie_consent_status) | Self-hosted (Hetzner) | Remembers Your consent choice so the banner does not reappear | First-party, persistent (localStorage) |
Consent visitor identifier (cookie_consent_visitor_id) | Self-hosted (Hetzner) | Random identifier used solely to associate Your consent choices with Our server-side consent-record log (see "How we record your consent" below) | First-party, persistent (localStorage) |
Consent policy version (cookie_consent_policy_version) | Self-hosted (Hetzner) | Remembers which version of this Cookie Policy Your choice was made under, so material policy changes re-prompt the banner | First-party, persistent (localStorage) |
Consent sync marker (cookie_consent_synced) | Self-hosted (Hetzner) | Remembers whether Your latest choice has been written to Our server-side consent-record log, so failed submissions are retried and duplicates avoided | First-party, persistent (localStorage) |
| Theme / language preferences | Self-hosted (Hetzner) | Remembers display preferences You set | First-party, persistent |
| Cloudflare WAF / Turnstile | Cloudflare, Inc. | Bot mitigation, abuse prevention, captcha | Third-party, session |
2. Error reporting (always on, treated as essential)
The following technology is loaded as essential to the security and reliability of the Service. We rely on the legitimate-interest legal basis under GDPR Art. 6(1)(f) for this processing.
| Technology | Provider | Purpose | Type |
|---|---|---|---|
| Bugsink (self-hosted error tracking) | Us (self-hosted on Our Hetzner infrastructure — no third-party provider) | Captures information about errors that occur during Your session (error message, stack trace, browser, IP address). Session replay and performance profiling are disabled. Transmission uses the open-source Sentry client SDKs; Sentry's hosted service is not used and receives no data. | First-party, persistent localStorage entries (used for error correlation only) |
3. Analytics (consent-required, opt-in via cookie banner)
These technologies are loaded only after You click "Accept all" on Our cookie banner. If You click "Reject non-essential" or do not interact with the banner, they are never loaded.
| Technology | Provider | Purpose | Type |
|---|---|---|---|
| Umami Analytics (page-view tracking) | Self-hosted by Us on Hetzner infrastructure | Anonymous page-view counts and basic usage metrics | First-party, cookieless (uses anonymized server-side identifiers only) |
Umami Session Replay (recorder.js) | Self-hosted by Us on Hetzner infrastructure | Records anonymized interactions with Our website (clicks, scrolls, form interactions with input masking) up to 20 minutes per session, to help Us understand and improve the Service | First-party, persistent |
| Cloudflare Web Analytics | Cloudflare, Inc. | Privacy-friendly, cookie-less page-view and performance metrics (page URL, referrer, browser, country derived from IP, basic timing) | Third-party, cookie-less — does not set persistent identifiers |
4. Functionality cookies (consent-required where applicable)
We do not currently use any third-party functionality cookies for personalization or social features. If We add any in the future, We will update this policy and request Your consent before loading them.
What we do not use
We want to be specific about what is not present on the Service:
- We do not use any advertising cookies, retargeting tags, or ad-network pixels. We also do not use any third-party advertising or marketing analytics platform: Our analytics are limited to self-hosted Umami and Cloudflare's cookie-less Web Analytics, and none of the data collected is used for advertising, remarketing, or audience building.
- We do not use cross-context behavioral advertising (CCPA-defined "sharing").
- We do not allow third parties to sell personal information collected on Our Service for monetary or other valuable consideration. (See our Privacy Policy "Sale and Sharing of Personal Information" section for details.)
- We do not use fingerprinting to track You across browsers or devices.
How we record your consent
When You interact with Our cookie banner — accepting or rejecting non-essential cookies, or later withdrawing a previous choice via the "Cookie preferences" link — We keep a server-side record of that choice for compliance purposes. Each record contains:
- The choice You made (accepted / rejected / withdrawn)
- The consent categories that choice applies to (necessary / analytics)
- The date and time of the choice
- The version of this Cookie Policy in force at the time
- Your browser's user-agent string
- A one-way hashed form of Your IP address (the raw IP address is not stored)
- The random visitor identifier stored on Your device (
cookie_consent_visitor_id) - Your account identifier, if You are signed in at the time of the choice
These records allow Us to demonstrate that consent was validly obtained, as required by GDPR Article 7(1), the EU ePrivacy rules, and comparable accountability obligations under the Singapore PDPA. They are retained for five (5) years from the consent event and are not used for any other purpose.
How to manage Your cookie preferences
On Our Service
The fastest way to change Your preferences is the "Cookie preferences" link in the website footer. Clicking it clears Your stored consent choice and re-displays the cookie banner so You can choose again. Withdrawing consent immediately disables the Umami tracker; the Umami session recorder and the cookie-less Cloudflare Web Analytics beacon stop at the next page load, after which no analytics scripts are loaded at all. Any first-party localStorage entries left behind by the Umami tracker can be removed via Your browser settings as described below.
In Your browser
You can also control or block cookies via Your browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Please note that disabling strictly-necessary cookies will prevent the Service from functioning correctly (for example, You will not be able to sign in).
Browser-level signals
We honor browser-transmitted Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information, in accordance with 11 CCR § 7025. Because We do not sell or share personal information for cross-context behavioral advertising, the GPC signal does not change Our processing — but it is logged and honored as a defense-in-depth measure.
We do not respond to Do Not Track (DNT) headers. Industry standards for DNT were never widely adopted, and most modern browsers no longer offer it as a setting.
Updates to this policy
We may update this Cookie Policy from time to time to reflect changes in the technologies We use or in applicable law. The "Last updated" date at the top of this page will change accordingly. Material changes that affect what cookies are placed will be accompanied by a re-prompt of the cookie banner.
Contact
If You have questions about this Cookie Policy, please contact us via Our contact page or at privacy@extensionauditor.com.