Cookies & browser storage
The short version: if you are not signed in, this site sets no cookies at all. Signing in sets one cookie so that you stay signed in. A few of your own choices — dark mode, text size, which route you picked, which lessons you ticked off — are kept in your browser and never sent anywhere. There are no analytics, no advertising and no third-party tracking.
Cookies
| Name | When | Purpose | Lifetime |
|---|---|---|---|
session |
Only after you sign in | Keeps you signed in. HttpOnly, Secure, SameSite=Strict, so it is not readable by scripts and is not sent to other sites. |
30 days, or until you log out |
cf_clearance, __cf_bm |
Only if Cloudflare challenges your request | Set by Cloudflare, our infrastructure provider, to tell a human apart from a bot after a challenge. We do not read them. | Set by Cloudflare; typically 30 minutes to 1 year |
Both are strictly necessary: one to provide the account you asked for, the other to keep the site available. Under the GDPR and the ePrivacy Directive, cookies of this kind require disclosure — this page — but not consent. We set no analytics, advertising or third-party tracking cookies, so there is nothing here to opt out of.
Storage in your browser
These are kept by your browser in localStorage on this site's own origin. They never leave your device, we cannot read them from the server, and they hold your own choices and your own work.
| Key | Holds | Why |
|---|---|---|
mciso:theme | Light or dark | So the site looks the way you set it. With no value, your operating system's setting decides. |
mciso:text-scale | Your reading size | So lessons stay at the size you chose. |
mciso:role | Aspiring, new or seasoned CISO | So the home page shows the route you picked. Copied to your account if you are signed in. |
mciso:lessons:<module> | Lessons you marked complete | So progress survives a refresh when you are signed out. Pushed to your account the next time you sign in. |
mciso:risk-register | The risk register you are building | So your work is not lost on refresh. Signed in, it is also saved to your account. |
mciso:notice-ack | That you dismissed the notice | So the banner does not reappear on every page. |
All of these exist to deliver something you explicitly asked for, which is why they fall under the same strictly-necessary exemption as the session cookie. To clear them, use your browser's "clear site data" for modularciso.com, or a private window, where nothing persists after you close it. Clearing them loses only those preferences and any signed-out progress — nothing on your account changes.
Third parties
Content pages — the home page, the curriculum, the lessons — make no third-party requests at all. Web fonts used to be loaded from Google, which sent your IP address to Google on every page view; since v0.43.1 they are served from this site.
Three tool pages are the exception. The Risk Assessment Engine, the Policy Generator and a few others load the libraries that build PDF, DOCX and PPTX files from cdnjs.cloudflare.com and cdn.jsdelivr.net. Those requests tell the CDN your IP address and which file you asked for. They carry no cookies and no identifier from us, and nothing about them is reported back to us.
Signing in with Google, GitHub or LinkedIn contacts that provider — but only after you choose that button.
What we do not do
- No analytics cookies or scripts, first-party or third-party.
- No advertising, no ad networks, no retargeting, no fingerprinting.
- No sale or sharing of personal data.
- No consent-management vendor — which would itself be a third party reading your browser.
We do count page views server-side, with no user ID, no IP address and no cookie, so we can tell which lessons get read. The privacy policy explains that, along with the security logs, the session data and the per-account watermark in the curriculum text.
The notice you may have seen
Visitors in the EU, EEA, UK and Switzerland see a short notice at the bottom of the page the first time they arrive. It is informational: there is nothing non-essential to accept or reject, so it does not pretend to offer a choice that does not exist. Dismissing it stores mciso:notice-ack so it stays dismissed. Where you are is determined from the country Cloudflare already knows for your request; your IP address is not stored or logged for this, and no cookie is involved.
Questions
Anything unclear, or something here that does not match what you observe in your browser's developer tools? That is worth knowing about: privacy@modularciso.com.