Cookie Policy
Last updated: 21 October 2026
We set three cookies. Two are needed for login and forms; one remembers that you closed a prompt. There are no advertising cookies, no third-party cookies and no analytics cookies, which is why you are not shown a consent banner. Two things that are not cookies, but that you would want to know about anyway, are covered below: a device fingerprint taken at sign-up for fraud prevention, and cookieless analytics on the research hub.
1. The cookies
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
sessionid |
Keeps you logged in and links your browser to your account session. Also set for visitors who open the contact page, so the form can be protected. | Strictly necessary. HttpOnly, so scripts cannot read it. | 7 days, renewed on each visit. If you leave "Remember me" unticked at login, it expires when you close the browser. |
csrftoken |
Protects every form on the site against cross-site request forgery. Without it, no form submits. | Strictly necessary | 12 months |
telegram_popup_dismissed |
Remembers that you closed the Telegram chat prompt so it stops reappearing | Functional. Set by a script only after a logged-in user dismisses the prompt. | 7 days |
Strictly necessary cookies do not need consent under the ePrivacy Directive or the UK PECR. The functional cookie holds a single flag and no identifier, and it is only ever set by something you did. We do not use localStorage.
2. Why there is no banner
Consent banners exist for cookies the site does not need in order to work: advertising, cross-site tracking, third-party analytics. We have none of those. All three cookies above are either required for the site to function or set only in response to your own click. There is nothing to ask consent for, so we do not ask. If that ever changes, the new cookie goes in the table above and a consent mechanism goes up before the script does.
3. Device fingerprinting at sign-up
When you register, a script in your browser builds a device fingerprint from canvas and WebGL rendering, installed fonts, screen size, platform, user agent, timezone and language, plus the timing of how you fill in the form. It is sent once, with the registration, and stored in a fraud-prevention table linked to your account alongside your IP address and its network type. It is not a cookie and nothing is left in your browser. It is not used to recognise you on later visits or anywhere else on the site. It exists for one reason: to spot the same device opening many accounts. Today it only flags; a human decides what happens next. It is kept for up to 12 months. The Privacy Policy has the full list of what is recorded.
4. Analytics on the research hub
The security research post pages, and only those, run GoatCounter, self-hosted on our own server. It sets no cookies. It records the page path, the referrer, screen size, browser family, language, and a salted hash of your IP address and user agent that rotates daily, so a visit on Monday cannot be tied to one on Tuesday. The IP address itself is not stored. Nothing goes to any analytics company. The rest of the site has no analytics.
5. Third parties
Nothing is requested from a third party when a page loads. Fonts and icons are served from our own server, so no font or icon CDN sees your visit. The one possible third-party embed is a YouTube or Vimeo player on a product page, and it loads only if you click to play a product video. From that click, their cookies and privacy terms apply.
When you pay, you are sent to the payment processor's own page. Their cookie policy applies there, not ours.
6. Server logs
Separately from cookies, our web server records each request: IP address, timestamp, requested URL, user agent and response code. This is operational logging for security, abuse investigation and debugging, not profiling. Retention is in the Privacy Policy.
7. Controlling cookies
You can block or delete cookies in your browser settings. Blocking sessionid or csrftoken will break login and every form on the site. That is not us being difficult; it is how session authentication works. Blocking telegram_popup_dismissed just means the prompt comes back.
Browser instructions: Chrome, Firefox, Safari, Edge.
8. Changes
If we add a cookie, it appears in the table in Section 1 and the date at the top changes. Anything that is not strictly necessary or functional will ask for your consent before it is set.
9. Contact
Questions about this page: support@lexlabtools.com or Telegram @lexlabtools.