Cookie Policy
The cookies Outranked.me sets, and why.
Last updated
Pre-launch review required
This document is an operator-ready draft that accurately describes how this system behaves. Passages in square brackets are placeholders for the operating entity’s details and must be completed and reviewed by a qualified lawyer before launch.
Cookies we always set
These keep the site working or remember a choice you made. None of them is used for analytics or advertising.
- Session cookie — identifies you while signed in. Strictly necessary. HTTP-only, Secure, SameSite=Lax. Expires after 30 days or when you sign out.
- CSRF cookie — protects form submissions from cross-site forgery. Strictly necessary. Expires after 12 hours.
- Theme cookie — remembers whether you chose light or dark mode. Functional, contains no personal data. Expires after one year.
- Cookie choice (orm-consent) — remembers whether you accepted or declined analytics cookies, so we do not ask on every page. Expires after 180 days.
Analytics cookies, only if you accept
On public pages we use Google Analytics to count page views, and Microsoft Clarity to see how pages are used through heatmaps and session recordings. Clarity never captures what you type into forms, and neither tool is started on account, administration, checkout, claim or sign-in pages.
These cookies are set only after you click Accept on the cookie banner:
- _ga — Google Analytics. Distinguishes visitors. Expires after 2 years.
- _ga_<id> — Google Analytics. Keeps session state. Expires after 2 years.
- _clck — Microsoft Clarity. Keeps the same Clarity visitor ID on this site.
- _clsk — Microsoft Clarity. Joins page views into one session recording.
- CLID, MUID, MR, SM and ANONCHK — set by Microsoft on its own domains when Clarity runs with your consent. Microsoft describes MUID as identifying browsers across Microsoft sites for advertising, site analytics and other operational purposes. We tell Clarity that advertising storage is denied, but Microsoft does not document whether that prevents these cookies.
If you decline, or have not chosen
Both tools still run on public pages, but every page load tells them that consent is denied, so they set none of the analytics cookies above and cannot recognise you across pages or visits.
You can change your choice at any time with Cookie settings at the bottom of every page. Declining removes the _ga, _ga_<id>, _clck and _clsk cookies from this site. Cookies Microsoft set on its own domains can only be cleared in your browser.
What we do not set
We set no advertising cookies ourselves, and we tell both analytics tools that advertising storage is denied, whatever you choose.