Threatless

Cookie Policy

This policy describes the cookies and similar technologies Threatless uses on trythreatless.com and how they relate to the Scan API.

Last updated 6 September 2026

Threatless uses a small number of strictly necessary cookies to authenticate you and keep the dashboard working. The public marketing and documentation pages do not currently set advertising or analytics cookies.

Contact: contact@trythreatless.com. See also the Privacy Policy.

1. What is a cookie

A cookie is a small piece of data stored on your device by a website. Threatless also uses browser storage that behaves similarly (a first-party token cookie readable by the web application). These technologies are treated together in this policy.

2. Cookies we use

Access token (token)

  • Purpose: keep you signed in to the dashboard, scanner, API keys, billing, and settings
  • Set by: the Threatless web application on trythreatless.com
  • Duration: up to 7 days of cookie lifetime; the JWT itself expires in about 15 minutes and is refreshed while you are active
  • Type: first-party, essential

Refresh session (API httpOnly cookie)

  • Purpose: issue a new access token without asking you to type your password every 15 minutes
  • Set by: the Threatless API (api.trythreatless.com)
  • Duration: 15 days, or until you log out or revoke the session
  • Type: first-party, httpOnly, essential

Google sign-in

If you choose “Continue with Google”, Google will set its own cookies as part of OAuth. That processing is subject to Google’s policies. Threatless only receives the account identifiers needed to create or sign in to your Threatless user.

Stripe

Paid checkout and the customer portal are hosted by Stripe. Stripe may set cookies on its domains when you open those flows. Threatless does not use Stripe cookies on marketing pages.

3. What we do not use today

  • No advertising cookies
  • No third-party marketing pixels on the hosted marketing site
  • No optional analytics SDK in the application as of the date on this page

If we introduce non-essential analytics later, we will update this policy and, where required, ask for consent before setting those cookies.

4. How to manage cookies

Essential cookies cannot be disabled in-product without breaking login. You can:

  • Log out, which clears the Threatless session cookies we control
  • Revoke other devices from account settings / the sessions API
  • Delete site data in your browser
  • Use your browser’s block-third-party-cookies controls (they do not affect first-party essential cookies)

Blocking the token or refresh cookie will prevent use of the dashboard. The public Scan API with X-API-KEY does not require cookies.

Essential cookies are used because they are necessary to provide a service you requested (an account and authenticated API/dashboard). Where ePrivacy or GDPR rules require consent for non-essential cookies, we will not set those cookies without it.

6. Updates

We will change the date at the top of this page when the cookie set changes in a material way.