Last updated 30 October 2026
The cookie this site sets
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| scraply_session | Keeps you signed in. Holds a signed session token that the server matches against a stored SHA-256 hash and an expiry. | 24 hours | Strictly necessary |
It is set with HttpOnly (page scripts cannot read it), Secure (sent over HTTPS only) and SameSite=Lax (not sent on cross-site form posts). Signing out deletes it.
No account token, API key or password is written to localStorage or sessionStorage. The session lives in the cookie and a hash of it on the server.
Cookies set by the network in front of us
The site is served through Cloudflare, which screens requests for bots and attacks before they reach the application. Cloudflare may set its own security cookies, such as __cf_bm (about 30 minutes) or cf_clearance when a browser has passed a challenge. They are required for that protection to work and are controlled by Cloudflare's own policy rather than by Scraply.
What is not used
- No advertising or retargeting cookies.
- No analytics cookies and no third-party measurement script. There is no Google Analytics, no Meta pixel and no session replay.
- No cross-site tracking, fingerprinting or identity graph.
- No cookie consent popup, because every cookie described above is strictly necessary to deliver a page you asked for.
Controlling cookies
Every browser lets you view, block and delete cookies, usually under Privacy or Site data in its settings. Blocking or deleting scraply_session signs you out and prevents signing in again until cookies are allowed for this site. Your API keys are unaffected: they are sent in a request header, not in a cookie.
Private browsing windows discard the session cookie when the window closes.
More detail
What is stored beyond cookies, and for how long, is described in the Privacy Policy. Questions go to support