Cookies Policy
Last updated: June 15, 2026 | Version 1.1 | Technical manifest:
storageManifest.tsThis Cookies Policy applies to the CometWeb Insight application at app.cometweb.io. The controller is Maciej Zmitrukiewicz (CometWeb). Contact: hello@cometweb.io.
1. What are cookies
Cookies are small files stored in your browser. In the Service we use them mainly for session management and security.
2. Categories
2.1. Essential
Required for the Service to work — no consent required:
- Session token (httpOnly, Secure) — keeps you signed in
- CSRF token — protects against unauthorized requests
- Language and theme preferences — remembers UI settings
2.2. Analytics (optional)
Used only after cookie-banner consent and with behavior tracking
enabled under Settings → Your data. They support pseudonymous
product analytics (including user_id, session_id, page
path, clicks, scroll depth) to improve the Service — not third-party marketing
profiles.
2.3. Functional
Remembers banner choices, onboarding progress, scan resume stubs, and dismissed in-app notices. Browser-local writes require the Functional category in the cookie banner (the backend still stores onboarding after sign-in).
2.4. Cookieless measurement (Cloudflare Web Analytics)
Cloudflare, our edge network provider, may add the Cloudflare Web Analytics script
(static.cloudflareinsights.com) to app pages to measure page load times
and count page views. The script stores nothing on your device (no cookies, no
localStorage) and assigns no identifier. Cloudflare receives your IP address and the
technical details of the request, as with any connection to the Service. While this
measurement is enabled the script loads regardless of your banner choice, because the
Cloudflare network adds it, not the application code.
3. Cookie inventory
| Name | Type | Purpose | Retention | Category | Basis | Removal |
|---|---|---|---|---|---|---|
access_token | Cookie (httpOnly) | Maintains signed-in session | Until session expiry / logout | Essential | Contract | Logout or token expiry |
refresh_token | Cookie (httpOnly) | Refreshes session without re-login | Up to 7 days or logout | Essential | Contract | Logout |
csrf_token | Cookie (readable by the page script, Secure) | CSRF protection (double-submit pattern: the page script copies the value into a request header) | 24 hours (renewed at sign-in and session refresh) | Essential | Legitimate interest | Logout or after 24 hours |
websocket_token | Cookie (httpOnly) | WebSocket auth for scan progress | Until session expiry | Essential | Contract | Logout |
cw_session_hint | Cookie | Marks that this browser has a session (value 1, no identifier) so public pages skip the session check when there is none | Up to 7 days or logout | Essential | Contract | Logout or session expiry |
cometweb-locale (cookie) | Cookie | Preferred UI language, read by the server when it renders a page | 1 year | Essential | Contract | Browser settings / clear site data |
cw_consent (cookie) | Cookie | Records that a cookie-banner decision exists (policy version only, not the choices) so the server does not show the banner again | 12 months from decision | Essential | Legitimate interest | 365-day expiry, policy change, or clear site data |
4. localStorage inventory
| Key | Purpose | Retention | Category | Basis | Removal |
|---|---|---|---|---|---|
cometweb-locale | Preferred UI language | Until cleared | Essential | Contract | Browser settings / clear site data |
cw_consent | Cookie banner choice (analytics / functional) | 12 months from decision | Essential | Legitimate interest | 365-day expiry, policy change, or clear site data |
cw_checkout_intent | Resumes an initiated plan purchase after e-mail verification and login | Up to 24 hours or first use | Essential | Contract | After redirect to Billing, 24-hour expiry, or clear site data |
cometweb_settings | Local UI settings cache (theme, regional) | Until cleared | Essential | Contract | Clear site data |
cometweb_active_workspace:{userId} | Last selected team workspace | Until cleared | Essential | Contract | Logout + clear site data |
cometweb_active_project:v1:{userId}:{workspaceId} | Last selected project — preserves context across reload | Until cleared | Essential | Contract | Logout or clear site data |
cw_a11y_manual_checklist_v1:{projectId} | Accessibility manual test plan draft (owner/status) | Until cleared | Functional | Consent | Clear site data |
cw_ai_chat_disclosure_ack_v1 | AI disclosure acknowledgement (EU AI Act) | Until cleared | Essential | Legitimate interest | Logout cleanup or clear site data |
cometweb_onboarding_v2:{userId} | Onboarding progress (tours, checklist) — local copy | Until cleared | Functional | Consent | Disable functional cookies, onboarding reset, or clear site data |
cometweb_onboarding_checklist_snooze_until:{userId} | Onboarding checklist panel snooze expiry | Until snooze ends (default 7 days) | Functional | Consent | Snooze expiry or disable functional cookies |
cw_module_refresh_jobs_v2:{userId}:{workspaceId} | Resume Smart Refresh after page reload | Up to 90 min from write (stale job discard) | Functional | Consent | Job completion or disable functional cookies |
cw_crawl_pages_cols_v1 | Visible column choice in the crawler pages table | Until cleared | Functional | Consent | Disable functional cookies |
cw_lens_banner_dismissed | Dismiss Comet Lens banner on projects list | Until cleared | Functional | Consent | Disable functional cookies |
cw_seo_context_banner_dismissed_{projectId} | Dismiss SEO measurement context banner | Until cleared | Functional | Consent | Disable functional cookies |
cometweb.monitoring.alerts-hint.dismissed | Dismiss monitoring alerts hint | Until cleared | Functional | Consent | Disable functional cookies |
cw:v2:*:analysis:* | Browser analysis history, URLs, and result metadata (scoped) | Until cleared / logout (scoped per user+workspace) | Functional | Consent | Logout, account switch, or disable functional cookies |
cometweb_analysis_history (legacy) | Legacy global analysis history (pre per-user isolation) | Purged on migration — never hydrated | Functional | Consent | Purged on login / auth transition |
cometweb_recent_urls (legacy) | Legacy global recent URLs | Purged on migration — never hydrated | Functional | Consent | Purged on login / auth transition |
cometweb_results_* (legacy) | Legacy global analysis results cache | Purged on migration — never hydrated | Functional | Consent | Purged on login / auth transition |
cw.ai_insights.* | AI Insights UI state and fast cache | Until cleared / cache TTL | Functional | Consent | Logout or disable functional cookies |
cometweb_projects:v3:{userId}:{workspaceId} | Projects list fallback when IndexedDB unavailable | Until cleared | Functional | Consent | Disable functional cookies |
cometweb_health_score:v2:{userId}:{workspaceId}:{projectId} | Dashboard project health score cache (user+workspace scoped) | Until cleared | Functional | Consent | Disable functional cookies or project/workspace switch |
cometweb_health_score_{projectId} | Legacy health score cache (no user/workspace scope) | Legacy — migrate to v2 on write | Functional | Consent | Overwrite by v2 or disable functional cookies |
serp_keyword_pref:v2:{userId}:{workspaceId}:{projectId} | SERP keyword mode and phrase (user+workspace scoped) | Until cleared | Functional | Consent | Disable functional cookies or workspace switch |
serp-keyword-pref:{projectId} | Legacy SERP keyword mode/phrase (no user/workspace scope) | Legacy — migrate to v2 on read | Functional | Consent | v2 migration or disable functional cookies |
serp_keyword_history:v2:{userId}:{workspaceId}:{projectId} | Manual SERP keyword history (user+workspace scoped) | Until cleared (max 10 phrases) | Functional | Consent | Disable functional cookies or workspace switch |
serp-keyword-history:{projectId} | Legacy SERP keyword history (no user/workspace scope) | Legacy — migrate to v2 on read | Functional | Consent | v2 migration or disable functional cookies |
cometweb-billing-currency | Preferred pricing currency (PLN/USD) | Until cleared | Functional | Consent | Disable functional cookies |
cometweb_selected_industry | Selected industry for industry benchmark | Until cleared | Functional | Consent | Disable functional cookies |
ecology_monthly_visits:v2:{userId}:{workspaceId}:{projectId} | Disclosed monthly visits (user+workspace scoped) | Until cleared | Functional | Consent | Disable functional cookies or workspace switch |
ecology-monthly-visits:{projectId} | Legacy monthly visits disclosure (no user/workspace scope) | Legacy — migrate to v2 on read | Functional | Consent | v2 migration or disable functional cookies |
cometweb_geo_cache_invalidated_at | GEO cache invalidation timestamp after locale change | Until cleared | Functional | Consent | Disable functional cookies |
remediation_completed_* | Completed WCAG remediation plan tasks | Until cleared | Functional | Consent | Disable functional cookies |
cometweb_tech_roadmap:{projectId} | Tech Stack Spy roadmap checkbox state | Until cleared | Functional | Consent | Disable functional cookies |
cw_public_link_tokens_v1:{projectId} | Legacy — public report link tokens (purged on UI mount) | Until cleared (max 50 tokens) | Functional | Consent | Auto-purge on mount or disable functional cookies |
manual_audit_draft | Manual accessibility audit tool draft | Until cleared | Functional | Consent | Disable functional cookies |
cometweb_onboarding_projects_v1:{userId} | Legacy onboarding v1 (migrates to v2) | Until migration / cleared | Functional | Consent | v2 migration or disable functional cookies |
5. sessionStorage inventory
| Key | Purpose | Retention | Category | Basis | Removal |
|---|---|---|---|---|---|
cw_funnel_once_v1 | Funnel events already sent in this session — prevents double counting | Until the tab is closed | Analytics | Consent | On tab close or withdrawal of telemetry consent |
cw_send_to_draft_v1 | Carries the ticket draft from the finding view to the "Send to" form | Until the ticket form opens or the tab is closed | Essential | Contract | After the form opens, on tab close, or clear site data |
cw_admin_step_up_v1 | Holds the admin operation intent (purge / soft delete) across the MFA step-up | Up to 15 minutes or until the Auth0 reauth returns | Essential | Legitimate interest | After the operation resumes, on cancel, 15-minute expiry, or tab close |
cw_admin_purge_step_up_v1 | Drains admin intents stashed before the move to cw_admin_step_up_v1 | Legacy key (Wave 8) — only drained and removed | Essential | Legitimate interest | On first read, when the operation resumes, or on tab close |
cw_claim_report_intent | Resumes report claim via opaque intent_id (no raw bearer token) | Up to 30 minutes or first use | Essential | Contract | After successful claim, 30-minute expiry, or tab close |
cw_active_analysis_sessions_v1:{userId} | Active scan stubs for current session | Up to 6 h / until tab close | Functional | Consent | Tab close, scan completion, or disable functional cookies |
analytics_session_id | Analytics session id (time on page, interactions) | Until tab/browser close | Analytics | Consent | Withdraw analytics consent or close tab |
cometweb.tasks.groupBy | Tasks board grouping mode | Until tab close | Functional | Consent | Disable functional cookies |
cometweb.tasks.groupExpanded.* | Expanded task board groups | Until tab close | Functional | Consent | Disable functional cookies |
cometweb.tasks.aiStrategyExpanded.* | Expanded AI Strategy view sections | Until tab close | Functional | Consent | Disable functional cookies |
cw_report_preview_branding_{projectId} | Temporary report preview branding overrides | Until tab close | Functional | Consent | Disable functional cookies |
cw_report_poll_v1:{projectId} | In-flight PDF report generation job id | Until tab close / generation completes | Functional | Consent | Disable functional cookies |
oauth_login_in_progress | Prevents duplicate OAuth popup | Until OAuth completes / tab close | Essential | Contract | OAuth callback or tab close |
cw_chunk_reload | Guards against chunk auto-reload loops | Once per tab session | Essential | Legitimate interest | Tab close |
cw_init_reload | Guards against stuck boot auto-reload loops | Once per tab session | Essential | Legitimate interest | Tab close |
projects.sortBy | Remembers projects list sort order for the session | Until tab close | Functional | Consent | Tab close or disable functional cookies |
6. Managing cookies
You may withdraw analytics consent in the banner or browser settings. Disabling essential cookies will prevent sign-in.