1. What this notice covers
Cookies, and every other way in which our website or the app saves information on your device or reads it from your device: the browser's local storage and session storage, and scripts that read signals from your browser for security.
Stripe's payment page, where you pay for a paid plan, is Stripe's own website: Stripe's cookie notice covers it.
2. Public website
The public website does not set cookies and does not load analytics or advertising scripts. Our servers count visits from what each request carries, without a cookie and without saving or reading anything on your device; the privacy notice, under “Counting visits and use”, says how. If you pause the site's motion, that choice is saved in your browser's local storage on your device only.
3. The app: cookies for signing in and security
The app uses only cookies that are strictly necessary for signing in and keeping your account secure. Our own code sets none of them: they come from our sign-in provider, Clerk, and from Cloudflare, which delivers our website and Clerk's sign-in address for TapForNetwork.
__session (Clerk, our sign-in provider, on the app's address): Holds a short-lived sign-in token, so the app knows it is you. How long: The token inside is valid for about a minute and is renewed while you use the app; it goes when you sign out.
__client_uat (Clerk, on the app's address): Records when you last signed in or out, so the app can tell whether you are signed in. It holds a time, not your details. How long: Until you sign out, or for as long as Clerk sets it.
__client (Clerk, on its sign-in address for TapForNetwork (clerk.tapfornetwork.com)): Keeps you signed in on this device. Your browser's own scripts cannot read it. How long: As long as your sign-in lasts, or until you sign out.
__clerk_db_jwt (Clerk, on test versions of the app only): Links a browser to a test sign-in. It is not used on tapfornetwork.com itself. How long: Until you sign out of the test version.
__cf_bm (Cloudflare, on Clerk's sign-in address for TapForNetwork (clerk.tapfornetwork.com), and on our own address when our bot protection is on): Tells people from automated attacks. How long: Until 30 minutes pass without activity.
_cfuvid (Cloudflare, on Clerk's sign-in address for TapForNetwork (clerk.tapfornetwork.com)): Lets Cloudflare's limits on how often the sign-in can be used tell apart people who share one network address, for example in an office, so that one person's limit does not stop the others. How long: As long as Cloudflare sets it.
cf_clearance (Cloudflare, only if it asks your browser to pass a security check on our address): Remembers that your browser passed that check, so you are not asked again at once. How long: As Cloudflare sets it, usually a short time.
Clerk also sets some of these cookies a second time with a short code added to the name, for example __client_uat_ followed by letters and digits, for the same purpose and for as long.
Clerk can rename or add cookies for the same purposes in a new version of its sign-in code. When that happens, we update this notice.
4. Security checks that read your device
When the app opens, for example the page to sign up or sign in, Clerk's sign-in code loads a script from Clerk Protect (protect.clerk.com) at once, before you click anything. It reads signals from your device and browser, and connects to Clerk Protect on several network ports, to tell people from automated sign-ups. It is part of signing in, and protects your account.
Clerk Protect keeps a random number for this browser, and the result of its last check, in your browser's local storage: the next section lists both.
Before an import, and on the page “Ask not to be found”, Cloudflare's bot check (Turnstile) runs in your browser for the same reason; Clerk's sign-up form uses it too.
5. The app: settings saved on your device
The app's own code saves these few things in your browser's storage, never a password, a sign-in token or details about the people in your network:
tfn-motion (local storage): Remembers that you paused the moving parts of our pages on this device, on the website and in the app. How long: Until you switch motion back on, or clear your browser's data.
tfn.comfort. (local storage): Your comfort choices for this device (spacing, the page the app opens on, and whether single-key keyboard shortcuts are on), kept under your account's internal number, so that each person on a shared computer keeps their own. How long: Until you sign out on this device: signing out removes it.
tfn.entered (session storage): Notes that this tab has already opened the app, so the app takes you to your start page only once. How long: Until the tab closes, or you sign out.
tfn.tour (session storage): Where you are in a guided tour, so that a reload does not lose your place. How long: Until the tour ends or the tab closes.
tfn.signup.terms (session storage): Notes that you ticked the box for the Terms and the Privacy Notice on the sign-up page, and for which versions, so that you are not asked to tick it again a moment later. It holds no personal data. How long: Until your account has recorded your agreement, you sign out, or the tab closes.
tfn.reload (session storage): A mark that the page reloaded itself once after an update, so that it does not reload again and again. How long: Until the tab closes.
Our sign-in provider, Clerk, saves these in your browser's local storage when the app opens, for signing in and its security checks:
__clerk_environment (local storage): A copy of the settings of TapForNetwork's sign-in at Clerk (for example which ways to sign in exist), not details about you. Clerk uses it only when its server cannot be reached for a moment, so that the sign-in still loads. How long: Clerk uses the copy for 24 hours after it was saved, and saves a new one when the settings load again.
__clerk_protect_pid (local storage): A number that Clerk Protect makes at random for this browser, so that its security checks can tell that sign-up and sign-in attempts come from the same browser. Clerk says it holds nothing about your device. How long: Clerk sets no end: it stays until you clear your browser's data.
__clerk_protect_st (local storage): The short-lived result of Clerk Protect's last check, kept so that your open tabs share it and the check does not run again in each tab. How long: The result inside is valid for at most 24 hours; Clerk replaces it with a new one when it is needed.
Clerk can change these in a new version of its sign-in code. When that happens, we update this notice.
6. Why there is no cookie banner
The law allows storing or reading information on your device without asking for consent when it is strictly necessary for a service you asked for. Everything above is needed to sign you in, to keep your account secure or to remember a choice you made, and nothing optional is set, so there is nothing to ask you about. If we ever add optional cookies, analytics or anything else that is not strictly necessary, we will ask for your consent first, make refusing as easy as accepting, and update this notice.
7. How to control cookies and storage
You can see and delete cookies and stored data in your browser's settings. If you block the sign-in cookies, you cannot sign in to the app. Clearing your browser's data resets the choices saved on this device; your account's own settings stay.
8. Our promise
We set only the cookies listed here. On the website and in the app, our own code saves only what this notice lists. If you ever find another cookie set while you use them, it is a mistake: tell us at security@tapfornetwork.com and we will remove it.
9. Changes to this notice
When a provider changes its cookies, or we change what is saved on your device, we update this notice. Each version has a number and the date it takes effect.
What changed in this version
- Says that our servers count visits without cookies and without saving or reading anything on your device.
- Says that this list covers the website and the app.