G-309Legal
Planbase Cookie Notice
Related: Privacy Policy §14 · Subprocessors
Summary in plain language
- planbaseestimating.com and the docs set no cookies of their own. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn’t identify you.
- The account portal (app.planbaseestimating.com) uses cookies from Clerk, our sign-in provider, only to sign you in and keep your session secure. It also remembers, in your browser, which Workspace you last picked.
- We use no advertising, marketing or cross-site tracking cookies, anywhere.
- Because everything we use is either strictly necessary or doesn’t store anything on your device, we don’t show a cookie banner (§6).
1. Definitions
- “Cookie” means a small text file a website stores in your browser and reads back later.
- “Local storage” and “session storage” mean similar browser storage that a page’s scripts can read. Session storage is cleared when you close the tab.
- “Strictly necessary” means needed to provide a service you asked for (such as staying signed in) or to keep it secure.
- “First-party” means set by the site you’re visiting (including our own sub-domains); “third-party” means set by another domain.
- Other terms have the meanings in the Privacy Policy §2.
2. planbaseestimating.com (the website)
| Name | Type | Set by | Purpose | Lifetime | Necessary? |
|---|---|---|---|---|---|
| (none) | Cookie | Planbase | The website sets no cookies | ||
Cloudflare Web Analytics beacon (script from static.cloudflareinsights.com, reporting to cloudflareinsights.com) |
Script, no cookie, no local storage | Cloudflare | Counts page views, referrers, browser and country, and measures page speed, without identifying visitors or following them across sites | Nothing stored on your device | No (analytics without storage) |
Cloudflare Turnstile (on the beta and newsletter forms; frame from challenges.cloudflare.com) |
Script and frame; Cloudflare states Turnstile sets no cookies | Cloudflare | Checks that a person, not a bot, sent the form. It reads browser signals and your IP address for that check only | Nothing persistent | Yes (security) |
__cf_bm, _cfuvid (only when Cloudflare’s bot or rate-limiting protection applies to the request) |
Cookie | Cloudflare | Bot and abuse protection at Cloudflare’s network | __cf_bm 30 minutes; _cfuvid the browser session |
Yes (security) |
Our fonts are served from our own site, so no font service sees your visit.
3. docs.planbaseestimating.com (the docs)
| Name | Type | Set by | Purpose | Lifetime | Necessary? |
|---|---|---|---|---|---|
| (none) | Cookie | Planbase | The docs set no cookies | ||
vitepress-theme-appearance |
Local storage | The docs site | Remembers if you chose the light or dark theme | Until you clear it | Yes (a choice you made) |
__cf_bm, _cfuvid |
Cookie | Cloudflare | As in §2 | As in §2 | Yes (security) |
The docs don’t load the Cloudflare Web Analytics beacon: their security policy allows scripts from the docs site only. The “Ask the docs” box, when it’s on, stores nothing in your browser.
4. app.planbaseestimating.com (the account portal)
Sign-in uses Clerk. Clerk’s servers for our account run at clerk.planbaseestimating.com (and accounts.planbaseestimating.com), so its cookies are first-party to our domain.
| Name | Type | Set by / where | Purpose | Lifetime | Necessary? |
|---|---|---|---|---|---|
__client |
Cookie, HttpOnly | Clerk, on clerk.planbaseestimating.com |
Identifies your signed-in browser to Clerk, so your session can be renewed. Contains a signed token, not your name or email | Long-lived (until you sign out, or your browser’s limit) | Yes |
__session |
Cookie (readable by the page’s scripts) | Clerk, on our domain | Proves to our servers that you’re signed in. A signed token that contains your name and email (we added those claims so our servers can read them) | 60 seconds, renewed while you use the portal | Yes |
__client_uat |
Cookie | Clerk, on our domain | Records when your sign-in last changed, so the portal knows whether you’re signed in. Contains a timestamp only | Long-lived | Yes |
Suffixed variants of the above (e.g. __session_<suffix>, __client_uat_<suffix>) and __refresh_<suffix> |
Cookie | Clerk | The same purposes, in newer Clerk versions | As above | Yes |
| Clerk’s browser storage | Local or session storage | Clerk | Caches Clerk’s settings and keeps sign-in in step between tabs | Varies | Yes |
Cloudflare Turnstile (bot protection) and Clerk fraud protection (scripts from *.protect.clerk.com) |
Scripts and frames | Cloudflare, Clerk | Stop automated sign-ups and account takeover. They read browser and device signals for that purpose only | Per provider | Yes (security) |
planbase.workspace |
Local storage | Planbase | Remembers which Workspace you last chose, if you belong to more than one. Contains a Workspace ID | Until you clear it | Yes (a choice you made) |
planbase.desktop |
Session storage | Planbase | Remembers, during one sign-in, that you came from DimSum, so we can send you back to the app | Until you close the tab | Yes |
planbase.tester.landed |
Session storage | Planbase | Shows a one-time confirmation message after you join testing or save your tester answers | Read once, then removed; at most until you close the tab | Yes |
| Cloudflare Web Analytics beacon | Script, no storage | Cloudflare | As in §2. Cloudflare adds it to the portal’s pages | Nothing stored | No (analytics without storage) |
Google sign-in. If you choose “Continue with Google”, you go to Google’s sign-in page, where Google’s cookies apply under Google’s policies. We don’t control them.
Payments. When you check out, Paddle’s checkout (Paddle.js) runs in your browser as merchant of record and may set its own cookies for payment and fraud prevention under Paddle’s policies. We don’t control them.
5. Other addresses
| Address | Cookies |
|---|---|
| api.planbaseestimating.com | None. DimSum and the portal call it with a token in a header, not a cookie. Its email confirm and unsubscribe pages set none. |
| updates.planbaseestimating.com | None. DimSum sends its license file in a header. |
| admin.planbaseestimating.com (Planbase staff only) | Cloudflare Access sets CF_Authorization (who is signed in; 24 hours by default) and related security cookies (CF_AppSession, and on our Access team domain CF_Session and CF_Device). Strictly necessary. Customers never visit this address. |
6. Do we need a cookie banner?
6.1 United States. No US law requires a consent banner for strictly necessary cookies or cookieless analytics. We don’t sell or share data for targeted advertising, so no “Do Not Sell or Share” cookie controls are needed.
6.2 EU and UK. The ePrivacy Directive (Art. 5(3)) and the UK’s PECR require consent before storing or reading information on a device, except where it’s strictly necessary for a service the user asked for. Our assessment:
- Clerk’s sign-in cookies, Clerk’s and Cloudflare’s security checks, Access cookies,
planbase.workspace,planbase.desktop,planbase.tester.landedand the docs’ theme setting are strictly necessary or user-requested, so they’re exempt. - Cloudflare Web Analytics stores nothing on the device. But it runs a script that reads browser information (such as page-load timing), and some regulators treat any reading from the device as covered. Some (e.g. France’s CNIL) exempt privacy-friendly audience measurement that meets their conditions; the UK’s Data (Use and Access) Act 2025 amends PECR to exempt statistical analytics where users get clear information and an easy way to object.
We therefore keep the cookieless Web Analytics beacon on the website and the portal, with no banner. This notice (§2 and §4) tells you about it, and §7 explains how to block it.
6.3 If the answer changes, or we add any non-essential cookie, we’ll add a consent tool before that cookie is set.
7. Your choices
- You can block or delete cookies in your browser settings. If you block Clerk’s cookies, you won’t be able to sign in to the portal.
- Blocking
static.cloudflareinsights.com(for example with a content blocker) stops the visit counts and doesn’t affect anything else. - We treat a Global Privacy Control signal as an opt-out of sale and sharing, though we do neither.
8. Changes
We’ll update this notice, with its “Last updated” date and version, before we add or change a cookie or similar technology, and say so in the Privacy Policy change log.
9. Contact
privacy@planbaseestimating.com · Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA
Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA. Questions: legal@planbaseestimating.com.All legal documents.