cookies policy.

About this policy

This policy is provided by paperclip.it web services. It covers our public website, Paperclipit CMS and the Google Sheets connection journey. Contact [email protected] with questions. Our Privacy Policy explains the related use of personal information.

What cookies and similar technologies do

Cookies are small files stored by your browser. Local storage and other browser technologies can also remember information or support security checks. Session storage normally ends when the relevant browser session closes; persistent storage remains until its expiry or until deleted.

The public website

The public website's page code does not set analytics, advertising or preference cookies, or use local storage to track visitors. Reading the public pages does not require a CMS login. Infrastructure and form-security services can operate separately from the page code, as described below.

Fonts are requested from Google Fonts. This sends technical request information, including your IP address and browser details, to Google. Google states that its Fonts API does not set or log cookies. This is separate from signing into a Google account to connect Sheets.

Paperclipit CMS sign-in and security

The CMS uses necessary session cookies to maintain your signed-in session, remember a secure connection request and protect actions against request forgery. These support requested features such as editing content, managing forms and connecting Google Sheets. Blocking them can prevent sign-in or stop changes from being saved.

• CMS session cookie: identifies your server-side session. Its name is configured for the CMS deployment and normally ends in -session. The application's default expiry is two hours of inactivity; deployment settings may change it.

• Request-forgery protection: an XSRF-TOKEN cookie may be supplied for protected requests. Where used, its lifetime follows the session configuration.

• Remember-me cookie: if you choose a persistent sign-in option, an authentication cookie may keep you signed in beyond the ordinary session. Sign out and clear the CMS site's cookies on shared devices.

These cookies are used for account functionality and security, rather than advertising. The names and expiry times in your browser's site-data controls show the cookies actually issued by the CMS deployment you are using.

Form protection and Cloudflare

Where Cloudflare Turnstile is enabled, it checks browser and connection signals to help prevent automated form abuse. Depending on the security configuration, Cloudflare may use browser storage or a cf_clearance security cookie to remember a completed check. Its expiry depends on the site's configured challenge period. It is not a marketing cookie. See the Turnstile Privacy Addendum and Cloudflare's clearance documentation for details. If a security check prevents a message being sent, email us instead.

Connecting Google Sheets

When you choose to connect Google Sheets, you visit Google's sign-in, permission and file-selection interfaces. Google may use cookies and browser storage on its own domains to recognise your account, maintain sign-in and protect the authorisation process. Google controls those cookies and their duration under its cookie information and Privacy Policy.

The CMS keeps temporary authorisation state in your server-side session to check that Google's response belongs to the connection you started. The saved Google access and refresh tokens are held on the server, encrypted in the CMS database; they are not advertising cookies. Sending submissions from the CMS to Sheets is a server-to-server operation and does not itself require a visitor to sign in to Google.

Deleting browser cookies does not disconnect a saved Google Sheets integration or delete data already delivered. Use the form's Google Sheets settings to disconnect and your Google Account to revoke access. Remove stored submissions and spreadsheet rows separately when needed.

Your choices

You can inspect, block or remove cookies and site data through your browser's privacy settings. Settings may need to be changed separately on each device and browser. Removing CMS session cookies can sign you out; blocking Google's cookies can interfere with connecting an account.

Where consent is required for optional cookies or similar storage, we will ask before using them and provide a way to change that choice. This policy does not itself give consent, and continued browsing is not treated as consent.

Changes to this policy

We update this page when the services or storage technologies change. The date above shows when this wording was last updated.