This Cookie Policy explains how Sentinel Edge Networks LTD, registered in England and Wales under company number 17150600 ("Maskbreak", "we", "us"), uses cookies, browser storage, scripts, and similar technologies on maskbreak.com and associated subdomains ("the Website").
1. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. Similar technologies include browser local storage, session storage, and JavaScript-based signals used for security purposes. We use these technologies for sign-in, security, requested interface preferences, and product analytics with session recording (§2.5). Local storage, fingerprinting, and pixels are not outside privacy rules simply because they are not traditional cookies.
2. Storage We Use
2.1 Sign-in and interface storage
We use cookies to keep you signed in (localStorage only in a browser that refuses cookies), localStorage for a few saved preferences, and sessionStorage for state needed within a browser tab. The purpose and circumstances determine whether an exception to consent applies, not the storage technology. Security functionality and convenience preferences are listed separately below. Local storage has no automatic expiry unless the application or browser removes it.
Since 14 October 2026 your sign-in token is kept in the __Host-mb_session cookie, which page scripts cannot read; the server stores a token hash, account identifier, IP address and user agent in a session record for authentication and revocation. Server-side session records are separate from browser storage. The short-lived OAuth cookies below only bind a Google or GitHub sign-in redirect to your browser.
| Key and storage | Purpose | Duration | Type |
|---|---|---|---|
__Host-mb_session (cookie) |
Keeps you signed in to the dashboard (your session token). Secure, HttpOnly (page scripts cannot read it) and SameSite=Strict; the dashboard's own requests are accepted with it only when they carry the dashboard's request header. Cleared on logout. Since 14 October 2026. | 30 days from sign-in, or until logout | Essential |
mb_signed_in (cookie) |
Your account number, readable by our pages, so they know you are signed in without reading the session itself: the header shows “Dashboard” and the dashboard keeps its language choice and cached pages per account. It authenticates nothing. Secure and SameSite=Lax. Since 14 October 2026. | The same as the session: 30 days, or until logout | Essential |
sentinel_token (localStorage) |
Held your session token until 14 October 2026; a dashboard tab removes it on its next request once the cookie above is set. A browser that refuses cookies keeps using it to keep you logged in to the dashboard, as before. Cleared on logout. | Token valid for 30 days; the stored entry remains until the cookie replaces it, logout, or browser-data deletion | Essential |
mb_account (localStorage) |
The account number of the signed-in dashboard, so other open dashboard tabs notice a change of account and drop that account's cached pages. It authenticates nothing. | Until browser-data deletion | Essential |
__Host-maskbreak_oauth_g, __Host-maskbreak_oauth_gh (cookies) |
Random security values that bind a Google or GitHub sign-in redirect to the browser that started it. Secure, HttpOnly and SameSite=Lax; used only when you start that sign-in method, not for tracking. | 5 minutes; cleared when the callback is validated | Essential |
__Host-maskbreak_2fa (cookie) |
Random security value that binds a Google or GitHub sign-in awaiting its two-factor code to this browser, so the half-finished sign-in cannot be completed anywhere else. Secure, HttpOnly and SameSite=Lax; set only for accounts with two-factor authentication, not used for tracking. | 5 minutes; cleared when the code is accepted | Essential |
__Host-maskbreak_oauth_oa, __Host-maskbreak_admin, CF_Authorization (cookies) |
Only set in the browser of Maskbreak’s own operator, never for customers or visitors. Since 14 October 2026 admin sign-in goes through our single-sign-on provider with a passkey (Google, with __Host-maskbreak_oauth_ga, only as a documented emergency fallback): a random security value binds that sign-in redirect to the browser (SameSite=Lax), then the admin session itself (Secure, HttpOnly, SameSite=Strict). Cloudflare Access checks the operator’s sign-in before any admin request reaches our server and keeps its own sign-in cookie for those pages (CF_Authorization). The admin console also keeps a per-tab proof and the operator’s email address in that tab’s sessionStorage (maskbreak_admin_tab, maskbreak_admin_email), cleared when the tab closes. Strictly necessary for that sign-in; not used for tracking. |
5 minutes for the sign-in value; 12 hours for the admin session and the Access cookie, or until sign-out | Essential |
scta_dismissed_v1 (localStorage) |
Remembers when you dismissed the sticky call-to-action bar on product, comparison, use-case and playbook pages, so that it stays hidden for 7 days. It holds only that time. | Until cleared (read for 7 days) | Preference |
mb_mobcta_dismissed (localStorage) |
On blog articles on a phone, remembers when you dismissed the reading bar at the bottom of the screen, so that it stays hidden for 7 days. It holds only that time. | Until cleared (read for 7 days) | Preference |
stl_cmdk_seen |
Remembers that you have seen the dashboard command palette. Older browsers may still hold retired stl_setup_hide, stl_setup_sdk and mb_setup_mode preferences; the console no longer reads or writes them. |
Until cleared | Preference |
mb_lang, mb_console_lang:<account ID> (localStorage) |
Your selected website language (English, Deutsch or Eesti) and, separately, the console language of each account in this browser (EN, DE, or ET). The website language is also what the log-in, sign-up and password-reset pages show; when it is German or Estonian, those pages send it with the requests that email you a code or a welcome, so the email is in the same language, and we do not store it. A new account’s console starts in the language of the page it signed up on (English, German or Estonian), and you can switch it at any time at the bottom of the console’s sidebar. The account identifier scopes this local preference; it is not sent to an advertising service. | Until changed or cleared | Preference |
mb_last_signin (localStorage), _mb_signin_pending (sessionStorage) |
Remembers which sign-in method you last used successfully in this browser (Google, passkey, password or GitHub) so the log-in page can mark that button “Last used”. It holds only the method name, never your email address, password or any other credential, and it is not sent to us or anyone else. For Google and GitHub redirects the method is held in the tab until the sign-in completes. | Until cleared (replaced at each sign-in); the tab value until the sign-in returns or the tab session ends | Preference |
stl_dash_v1, stl_set_v1, stl_sec_v1, stl_mem_v1, stl_email, mb_console_account (sessionStorage) |
Recent signed-in console responses and your displayed email, so navigating between account pages does not start from a blank screen. This can include account, usage, session or team information available to your account, never your API keys. | Browser-tab session; refreshed or cleared by the application, and cleared on logout | Account |
_sentinel_invite, _sentinel_next, _mb_auth_from (sessionStorage) |
Preserves an organisation invitation and the requested account-page destination while you sign in, and whether a Google or GitHub sign-in started on the sign-up or log-in page, so a failed attempt returns there; removed when consumed. | Until consumed or the tab session ends | Account |
mb_recheck, mb_recheck_at (sessionStorage) |
When the console’s own browser check (“Check my visit now”) stalls, the page reloads once and runs it again; these hold only the time of that reload, so the check resumes after it and never reloads more than once in two minutes. | Removed when the check resumes; the time until the tab session ends | Interface |
mb_ev_page, mb_ev_cols (localStorage) |
Your choices on the console’s Events list (since 17 October 2026): how many rows a page shows and which optional columns are on. Nothing about your visitors. | Until you clear your browser’s site data | Interface |
mb_first_check_auto, mb_guide_on (sessionStorage) |
Whether the console already ran the check on your own browser by itself in this tab session, and whether the “Get started” entry shows in the sidebar of the account pages (since 17 October 2026). | Until the tab session ends | Interface |
mb_month_popup (sessionStorage) |
Remembers that the console already showed this month’s notice that your checks or address lookups are used up, or almost used up, in this tab session, so it shows once (since 21 October 2026). | Until the tab session ends | Interface |
mb_news_intel (localStorage) |
Remembers that you dismissed the console’s Overview card announcing login protection and email and phone intelligence, so it does not come back (since 23 October 2026). Nothing about your visitors. | A year, or until you clear your browser’s site data | Interface |
pg-auto, sm-human (sessionStorage) |
Avoids repeating the API playground’s automatic demo or an interface animation within the same tab. | Browser-tab session | Interface |
_sntl_sdk_v |
Version marker set by the page that runs our network check (the homepage scanner; the IP-lookup tool did too until 6 November 2026) so stale security-SDK storage is cleared once after a key rotation. Contains only a version number, or, after the homepage used its fallback network check (§3), a short marker so that your next visit clears the storage that fallback left behind. | Until cleared | Essential |
mb_scan_proxy (localStorage) |
When the live check on the homepage or the IP-lookup tool finds a proxy on your visit, the address it was seen on (an IPv4 address, or the first half of an IPv6 address) and the time, so that a check repeated from the same address within 15 minutes asks for review even when its own reading misses the proxy (since 31 October 2026). Only our pages read it in your browser; it is not sent to us or anyone else. | 15 minutes; an older value is removed when a later check reads it | Essential |
| Network-check state (localStorage / IndexedDB) | Session state our network check may keep between page loads on the homepage live check, the contact and public-interest forms and the dashboard (and, until 6 November 2026, the IP-lookup tool), for security and fraud prevention only. It holds opaque values, not your name, email address or account details. | Until cleared | Essential |
_iidt (cookie, HttpOnly, .maskbreak.com), _vid_t (cookie and localStorage), _vid_lr (localStorage) |
Pseudonymous identifiers and state written by our device check (homepage scanner, IP-lookup tool, contact and public-interest forms, and the console’s browser check) so it can recognise the same browser on a later visit, for security and fraud prevention only (§2.2). They hold opaque values, not your name, email address or account details. | Cookies 1 year; localStorage entries until cleared | Essential |
2.2 Security & Fraud Prevention
Security SDKs run on the homepage live check, the IP-lookup tool, the contact and public-interest forms, and the signed-in dashboard (the network check on every dashboard view; the device check when you run a check on your own browser and, since 17 October 2026, once by itself in each tab session while a new account is under a week old and has sent no checks of its own). They do not run on the sign-up, log-in, password-reset, settings, security or members pages. They process network signals (such as IP address, connection type, VPN/proxy status) and device signals (such as browser characteristics, tampering, and automation indicators) to prevent abuse of our forms and to run the checks you ask for or see on the page. Since 6 November 2026 the IP-lookup tool measures the connection with our proxy-detection provider’s script (§3) instead of our network check; that script stores nothing in your browser, and the page blocks its attempt to detect browser extensions.
These technologies are used only for security and fraud-prevention purposes, not advertising. The homepage live check starts by itself: the network check as the page loads, and the device check once the check is on screen (it is at the top of the page) or a few seconds after the page has loaded, whichever comes first. More detail about lawful bases, recipients, and retention is in our Privacy Policy.
Since 18 October 2026 the homepage and the sign-up page also run a short browser check of our own, for fraud prevention only. It stores nothing in your browser. It reads whether some of the browser’s built-in anti-fraud features are set up and agree with the browser it says it is, whether a known AI agent is working in the page, short codes from two test drawings, and counts of pointer, keyboard and scroll activity up to your first click (never which keys, what you type or where you click). The result goes to our server once per page load (Privacy Policy, Section 3, Application logs).
We also check passwords against the Have I Been Pwned breach database when you sign up, reset or change your password. Only a partial hash of the password is sent (k-anonymity) — your actual password is never transmitted.
If you wish to object to this processing under GDPR Article 21, please contact us at support@maskbreak.com. Note that objecting may prevent you from using certain features of the platform.
2.3 Analytics and advertising
We set no advertising cookies and do not run Microsoft Clarity, Google Analytics or retargeting pixels. Since 23 September 2026 we run PostHog product analytics with session recording on public pages, sign-up and the dashboard, without a consent prompt, as described in §2.5. There is no chat widget on our pages any more: the Widgo chat was removed on 30 September 2026 (§2.4).
Google Ads measurement is disabled as of 6 September 2026. The tag, its conversion-event calls and connection hints are gone from every page and from the page generators; Google Sign-In remains available as a separate authentication option. Before then the tag ran with its consent settings denied but could still send cookieless measurement pings with request and device information; removing it does not erase what Google already received. We will not reintroduce advertising technology without updating this notice.
2.4 Former chat providers
We removed the Widgo chat on 30 September 2026. From 22 September 2026 until then, its launcher loaded by itself on public marketing pages (not on sign-in, private account or result pages; browsers that sent Global Privacy Control, or were signed in to the Maskbreak console, got a button instead). No page loads it now, and our Content Security Policy no longer allows its hosts. Email support@maskbreak.com for help.
While it was loaded, Widgo processed request IP, browser/device characteristics, pages, referrer and campaign information and interaction timing, and, if you wrote to it, chat content and volunteered contact details. Identifiers it created before the removal can remain in your browser until they expire or you clear site data: widgo_sid in cookies (up to one year) and localStorage, widgo_verified_<organisation> cookies (up to 400 days) and localStorage, cache entries with the widgo_cfg_ and widgo_gone_ prefixes, and session entries such as widgo_closed_on. We no longer read or set any of them. Chat transcripts and records Widgo already holds are not deleted by the removal; Widgo’s privacy policy describes its retention, and you can email us for access or deletion requests.
Earlier provider: Crisp was replaced on 8 September 2026. Its existing crisp-client/ cookies and historical support records are not deleted by switching providers; clear site data or contact us as above. The old mb_chat_open preference no longer starts any chat.
2.5 Product analytics and session recordings (PostHog)
Since 23 September 2026 we use PostHog to see how people use maskbreak.com: which pages they view, what they click, and recordings of how a page was used, so that we can find what confuses visitors and where sign-up and setup fail. It starts by itself, without a consent prompt, once a page has finished loading. It runs on public pages, /signup and the dashboard. It never runs on sign-in, password-reset, verification, invitation, settings, security (including two-factor), members, admin or result pages, on a page whose address carries anything other than campaign parameters, or inside another site’s frame. It does not start at all if your browser sends Global Privacy Control or Do Not Track, or asks to save data.
What is recorded. Page views and page leaves (the address keeps only utm_* and ref campaign parameters, and an IP address in a page path is replaced), clicks with the text and position of what was clicked, the referring page, browser, operating system, device type and screen size, and a session recording: the page’s layout and visible text, mouse movement, scrolling, clicks and window size, rebuilt as a video-like replay. Since 17 October 2026 also page-speed measurements (Core Web Vitals: how long the page took to show its main content and to respond to a tap or click, and how much its layout shifted) and, on public pages and /signup, clicks that changed nothing on the page and errors in the page’s own scripts (the error type, message and code location, with addresses in them cleaned like page addresses). PostHog also receives the IP address of each request and can derive an approximate location from it. One random identifier follows a browser from public pages through sign-up into the dashboard.
What is masked or left out. Everything typed into a form field, including passwords, codes and your email address at sign-up, is masked in the browser before anything is sent. So are the homepage live check, the IP-lookup results, the API playground and the email address shown while you confirm sign-up, because they show your own IP address, network, location, verdict or email; clicks inside them are not captured, and the verdict panels appear as blank boxes in recordings. On the dashboard all text and attribute values are masked, so a recording shows the layout and where you clicked but not your API keys, signing secrets, email address or your visitors’ data, and the charts, event map and flags are left out. Console logs, network requests and their timings, request headers and bodies, and canvas content are never recorded, and no dead clicks or script errors are sent from the dashboard. We do not send PostHog your name, email address, account ID or API keys, and we do not create a named profile of you.
How it is loaded. The PostHog library (version 1.434.11) is served from maskbreak.com, not from PostHog. Our Content Security Policy lets the page send data to PostHog’s two EU hosts, eu.i.posthog.com (events and recordings) and eu-assets.i.posthog.com (project settings), but not load code from them, so PostHog cannot run new code on our pages. Data goes to PostHog EU Cloud, hosted in Frankfurt, Germany; PostHog, Inc. is a US company.
The library stores the following in your browser. <key> is our PostHog project key, phc_uc3uxaAkJMw67jkS6B8NFXxoDwRHYjXniGeDB3hQAzKY.
| Key and storage | Purpose | Duration | Type |
|---|---|---|---|
ph_<key>_posthog (cookie on .maskbreak.com, Secure, SameSite=Lax) |
A random identifier for this browser and the current session, so page views, clicks and recordings from the same browser can be grouped. | One year, renewed on each visit; a session ends after 30 minutes without activity or after 24 hours | Analytics |
ph_<key>_posthog (localStorage) |
The same identifier and session state, kept in step with the cookie. | Until cleared | Analytics |
ph_<key>_posthog, ph_<key>_session_registered_properties, ph_<key>_window_id, ph_<key>_primary_window_exists (sessionStorage) |
Tab-level state: which tab a recording belongs to and properties for the current session. | Browser-tab session | Analytics |
dmn_chk_<random> (cookie) |
A test the library writes to find which domain it may set its cookie on. | At most 3 seconds; removed straight away | Analytics |
Your choices. Turn on Global Privacy Control or Do Not Track in your browser, or block eu.i.posthog.com or /assets/analytics.js with a content blocker; any of these keeps PostHog from loading from then on. None of them deletes what was already stored or sent: clear the site data for maskbreak.com to remove the identifiers, and email support@maskbreak.com to object or to ask for access or deletion (the value of your ph_<key>_posthog cookie helps us find your data). PostHog keeps events for up to one year and recordings for up to 30 days on its free plan, longer on paid plans. PostHog’s privacy policy describes its own processing.
3. Third-Party Services
The following third-party services are integrated and may process data from your device:
| Provider | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Network intelligence provider | Network-layer fraud detection: VPN, residential proxy, datacenter, and Tor exit detection. Powers the core /v1/evaluate endpoint. On our pages its SDK loads from a maskbreak.com subdomain. Since 25 September 2026, when that subdomain cannot be loaded on the homepage or does not answer within a few seconds (some iPhones cannot reach it), the homepage check also loads the SDK from the provider’s own domain inside a hidden frame on maskbreak.com and uses whichever answers first; the page clears the SDK storage left by the other host before that load, and your next visit to the homepage clears what the fallback left behind. |
IP address, ASN and connection measurements; basic browser characteristics its script reads (user agent, languages, time zone, window size, processor count, automation flag); the encrypted token it returns. United States | Named to customers under DPA, and to anyone asking who received their data |
| Proxy-detection provider | Since 6 November 2026, the proxy check of the live check on our IP-lookup page only. Its script loads from the provider’s own domain on that page and stores nothing in your browser; it also tries to detect some browser extensions, which the page’s security policy blocks. Its encrypted answer is opened by our server, which also looks the visitor’s address up in the provider’s IP database. | IP address and connection measurements; the encrypted answer it returns (proxy or not, residential or ISP, the address measured, the time). United States | Named to anyone asking who received their data |
| Device intelligence provider | Device-layer intelligence: browser tampering, antidetect detection, bot/automation, emulator/VM, incognito. Loaded from a maskbreak.com subdomain; if that load is blocked, the device check is skipped (our pages do not load it from the provider’s own domain). |
Browser/device characteristics, IP address, pseudonymous identifiers and security signals. United States | Named to customers under DPA, and to anyone asking who received their data |
| Email- and phone-intelligence provider | The console’s email and phone check, since 18 October 2026: when an account holder types one email address or phone number into it, our server sends that value to this provider and shows the answer; we store neither. Since 23 October 2026 also email and phone intelligence on API checks (on by default for accounts created from that day, off for older accounts until they turn it on in Settings, and any account can turn it off there): the email addresses and phone numbers a customer that has it on sends with its visitor checks go to this provider and we keep its scores on the check, never the value. Server-side only — does not interact with your browser. | The address or number typed in, or sent with a visitor check by a customer that has the feature on. United States | Named to customers under DPA, and to anyone asking who received their data |
| Sift | Login protection, since 23 October 2026, on for every account (a customer can turn it off in Settings; nothing is sent until the customer’s server reports a login or an account event with its own account ID): our server sends each login attempt the customer’s server reports to Sift and returns Sift’s account-takeover score, and sends the account events the customer reports (signups, password changes, verifications, logouts, account-detail changes) the same way, with no score in return. Server-side only — we do not load Sift’s script, so it sets nothing in your browser. | Keyed hashes of the account and session identifiers, whether the password was right, the IP address, the browser’s user-agent string, the email address when the customer sends one, and our own result for the visit. United States | sift.com/site-privacy |
| Cloudflare | CDN, DDoS protection, and DNS for maskbreak.com; since 20 October 2026 also our application hosting (Containers, Eastern North America: our server and its logs, kept 7 days there, with a copy of the logs kept 30 days in R2 in its EU jurisdiction since 22 October 2026; server-side only); since 19 October 2026 also our email delivery (Email Service: the recipient’s address and the message; server-side only) and our primary database (D1, in the United States; server-side only); since 17 October 2026 also R2 storage for our encrypted nightly database backups, in Cloudflare’s EU jurisdiction (each copy removed after 40 days, within a 60-day commitment that a daily audit checks; server-side only); since 20 October 2026 also Browser Run, which opens a page an account holder asks the dashboard to check, and custom hostnames, which serve our script from a customer’s own subdomain. Cloudflare Access protects our internal admin console. Cloudflare also asks your browser to keep a network-error-reporting policy for 7 days and to report connections to our site that fail to Cloudflare (successful ones are not reported). Cloudflare may set __cf_bm for bot management (expires after 30 minutes of inactivity) and cf_clearance to remember a passed challenge (duration depends on the challenge-passage configuration). These are not necessarily session-only cookies. |
IP address, request metadata, TLS handshake fingerprint; reports of failed connections | cloudflare.com/privacypolicy |
| Stripe | Sells our paid plans as the merchant of record through its Managed Payments service, shown to you as Link: payments, invoices and receipts (since 30 September 2026). Checkout and the billing portal open on Stripe’s own website when an account holder chooses them in the console; Stripe’s cookies and similar technologies there are governed by Stripe’s own policies. No Stripe script, cookie or other storage is placed on maskbreak.com pages. | On Stripe’s pages only: email address, plan, payment and billing details, IP address and browser details. Card details never reach Maskbreak’s servers | stripe.com/privacy |
| PostHog | Product analytics and session recordings on public pages, /signup and the dashboard since 23 September 2026, without a consent prompt; not under Global Privacy Control, Do Not Track or Save-Data (Section 2.5). The library is served from maskbreak.com; PostHog EU Cloud (Frankfurt) receives the data. |
Pages viewed, clicks, referrer, browser/device type, IP address, a random browser identifier, and session recordings with form fields, the visitor’s own network readouts and all dashboard text masked | PostHog privacy policy |
| Sentry | Error reports from our server software since 24 September 2026, stored in Sentry’s EU region (Frankfurt). Runs only on our server: nothing is loaded in your browser or stored on your device. | Server-side error details only — request headers, cookies, bodies, query strings, IP addresses, email addresses, keys and tokens are removed before sending (pattern-based: a strong safeguard, not a guarantee) | Sentry privacy policy |
| Google Sign-In (OAuth) | Optional "Sign in with Google" authentication. On /login, Google’s sign-in client also loads by itself after the page has loaded to offer its “Continue as …” prompt (One Tap, sign-in to existing accounts only), except for browsers that send Global Privacy Control or Do Not Track; Google may read or set its own cookies on accounts.google.com when it does. Maskbreak sets no cookie for it. |
Email, name, Google account ID; on /login, when its prompt loads, your IP address and browser details |
policies.google.com/privacy |
| Google Workspace | Hosts our support@maskbreak.com mailbox: emails you send us, the contact and programme forms relayed to it, and our replies. | Server-side data only — does not interact with your browser | policies.google.com/privacy |
| GitHub Sign-In (OAuth) | Optional "Sign in with GitHub" authentication, where enabled and offered on the sign-in and sign-up pages. Used only when you choose that sign-in method. (Separately, our nightly backup job runs on GitHub Actions; it does not interact with your browser — see the Privacy Policy.) | Email, name, GitHub account ID | docs.github.com — privacy statement |
| flagcdn.com | Flag images in the dashboard’s test panel, requested by your browser when a console test result is shown. Sets no cookie for us. | IP address, browser details and the two-letter country code of the test result | Not published by the provider |
| Have I Been Pwned | Password breach check when you sign up, reset or change your password, using k-anonymity. Our server sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned; your password and the rest of the hash never leave our infrastructure. | Partial password hash prefix only | haveibeenpwned.com/Privacy |
Former providers
We no longer use these providers, and no page loads anything from them. Some may still hold data from the time we used them, as described.
| Provider | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Railway | Former application hosting and runtime infrastructure in the United States (US East), until 20 October 2026, when we shut our service there down; the application logs it kept are deleted by Railway within 30 days. | Server logs, IP address | railway.com/legal/privacy |
| Turso | Our managed cloud database (libSQL) in the United States (AWS us-east-1) until 19 October 2026; the database was deleted with our account the same night, and copies in Turso’s own backups follow its retention terms. Stored account and session records, API keys, evaluation and address-lookup records, newsletter subscriptions, and keyed abuse-prevention counters. | Server-side data only — does not interact with your browser | turso.tech/privacy |
| Amazon Web Services (S3) | Our backup store until 16 October 2026: it holds the encrypted nightly database backups made up to then, EU Stockholm region (eu-north-1), under a 60-day retention commitment that the daily audit confirmed from 10 October 2026. The account is suspended and we are not restoring access to it, so we can no longer check or delete those copies ourselves. | Server-side data only — does not interact with your browser | aws.amazon.com/privacy |
| Resend | Our email provider until 19 October 2026 (Cloudflare since): it delivered verification codes, password resets, security notices, form receipts, account setup emails, monthly summaries, newsletter confirmation emails and the newsletter. Our account was closed the same night; copies Resend may still hold in its own backups follow its retention terms. | Recipient email address and message content, including information you submit in a support or programme application | resend.com/privacy |
| Widgo | Public-page AI chat and visitor analytics from 8 September 2026 (opened by a click until 22 September) to 30 September 2026, when we removed it; no page loads it now (Section 2.4). | Records it already holds: chat content, volunteered contact details, IP, browser/device identifiers, page/referrer/campaign data and interaction timing | Widgo privacy policy |
| Auth0 (Okta) | Optional emailed sign-in link, offered until 5 October 2026 and removed since: no page or server route contacts Auth0 now. | None any more: we deleted the Auth0 tenant on 6 October 2026, with the user records (email address, sign-in metadata) it held from earlier use; any copies left in Auth0’s own backups are removed under Auth0’s retention terms | auth0.com/privacy |
Our specialised detection providers are listed by category: the composition of our detection stack is confidential security information. Customers can request the full named list, with each vendor's privacy policy, under their Data Processing Agreement — published self-serve at maskbreak.com/dpa — by emailing support@maskbreak.com; countersigned copies are available from the same address.
4. How to control storage
4.1 Browser settings
You can clear localStorage and cookies via your browser's developer tools or settings. Note that clearing the __Host-mb_session cookie (or, in a browser that refuses cookies, sentinel_token) will log you out of the dashboard. Clearing site data also removes the PostHog identifiers in §2.5. Instructions for major browsers:
5. International Transfers
Our application hosting (Cloudflare, Eastern North America, since 20 October 2026; Railway, US East, before) and database (Cloudflare D1, Eastern North America, since 19 October 2026; Turso, AWS us-east-1, before) are in the United States, and so are our network-, device- and email-and-phone-intelligence providers, Sift (login protection, for the logins and account events customers’ servers send) and GitHub. Some other providers, including Cloudflare, Resend (until 19 October 2026), flagcdn.com, PostHog (a US company; our analytics data is hosted in its EU region, but its data processing agreement allows processing elsewhere, including the US), Sentry (a US company; our server error reports are stored in its EU region, but its data processing agreement allows processing in the US), Stripe (payments for paid plans, on its own pages), and Google or GitHub Sign-In, may process data outside the UK and European Economic Area. Where required, we use an applicable adequacy regulation or contractual safeguards. See our Privacy Policy or contact us for more information.
6. Your rights
Information about access, correction, deletion, restriction, portability, objection, automated profiling, and complaints is set out in our Privacy Policy. Rights requests can be sent to support@maskbreak.com.
7. Changes to This Policy
We may update this Cookie Policy when our technology or legal obligations change. Material changes will be highlighted on the Website or sent to account holders where appropriate. The "Last Updated" date at the top reflects the most recent revision.
8. Contact
134a West Hendon Broadway, London, NW9 7AA, United Kingdom · Company number: 17150600