Legal
Cookie Policy
Last updated: October 11, 2026
This policy lists every cookie and other browser storage that maxspell.com, Maxspell ID, the dashboard and ahref.is use. We use no advertising or tracking cookies, and we do not let third parties track you across our sites.
Why We Show No Cookie Banner
Under the Finnish Act on Electronic Communications Services and the EU ePrivacy rules, a site may store information in your browser without asking first only when it is strictly necessary for a service you request. Everything below falls into that group: keeping you signed in, protecting forms and payments from abuse, and remembering choices you make. That is why we do not ask for cookie consent.
If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this page.
Cookies and Storage We Use
maxspell.com
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
theme | Local storage | Maxspell | Remembers whether you chose the light or dark theme. | Until you clear it |
umami.disabled | Local storage | Maxspell | Remembers that you turned analytics off. | Until you turn analytics back on or clear it |
Turnstile | Browser check | Cloudflare | Checks that a person, not a bot, sends the contact form or runs the SEO audit tool. Sets no cookies. | Only while you send the form |
__cf_bm | Cookie | Cloudflare | Set only when Cloudflare sees suspicious traffic, to tell people from bots. | 30 minutes |
Maxspell ID (sign-in, shared by *.maxspell.com)
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
mxspl.session_token | Cookie | Maxspell | Keeps you signed in. | 7 days, extended while you use the services |
mxspl.session_data | Cookie | Maxspell | A short-lived signed copy of your session, for speed. | 5 minutes |
mxspl.state, mxspl.oauth_state | Cookie | Maxspell | Protects sign-in with Google, Facebook or GitHub against forgery. | 10 minutes |
mxspl.better-auth-passkey | Cookie | Maxspell | Holds the one-time challenge while you use a passkey. | A few minutes |
dash.maxspell.com (dashboard)
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
Theme and last team | Local storage | Maxspell | Remembers your theme and the team you last opened. | Until you clear it |
__stripe_mid, __stripe_sid | Cookie | Stripe | Fraud prevention when you add a payment method or pay in Billing. | 1 year (__stripe_mid), 30 minutes (__stripe_sid) |
ahref.is (short links)
Nothing. Short links redirect without cookies or storage.
In production, cookie names from Maxspell ID may start with the browser security prefix __Secure-.
Analytics
maxspell.com measures visits with Umami, which we run on our own server. It sets no cookies and stores nothing in your browser. It records the page, referring site, browser, device type and country, and does not store your IP address. Visits are grouped with an identifier that changes every month, so we cannot follow you over time. ahref.is, Maxspell ID and the dashboard have no analytics.
We respect your browser's Do Not Track setting. You can also turn analytics off for this browser here:
Checking your analytics setting…
Third Parties
Cloudflare delivers our sites and runs Turnstile, and Stripe handles payments in the dashboard. They may process technical data such as your IP address to protect against bots and fraud. See our Sub-processors page and our Privacy Policy.
Managing Cookies
You can block or delete cookies and site data in your browser settings. If you block cookies from maxspell.com, you cannot sign in to Maxspell ID or use the dashboard.
Updates
We update this page whenever we change what we store in browsers, with a new date at the top.
Contact
Questions about cookies: email [email protected].