Cookie Policy

01 What is a cookie

A cookie is a small text file stored by your browser. Cookies can be "strictly necessary" (required for core functionality) or optional (analytics, advertising). Talon Audit uses only strictly necessary service cookies.

02 Cookies we set

• talon_session — strictly necessary. Set only after you sign in. It keeps you authenticated between requests. It is HttpOnly (not readable by JavaScript), Secure (sent only over HTTPS), SameSite=Lax, cryptographically signed, and expires after 30 days or when you sign out. It contains an opaque session reference — no personal data is stored in the cookie itself.
• talon_trial — strictly necessary. Set after a guest audit so the one-free-scan allowance can be enforced without requiring account creation. It is HttpOnly, Secure, SameSite=Lax, and expires after 30 days.
• talon_guest — strictly necessary. Set when you run a guest audit. It is a random key that ties the guest report to the browser that ran it, so nobody else can open the report even with its link; only a one-way hash of it is stored on our side. It is HttpOnly, Secure, SameSite=Lax, and expires after 30 days, the same as the guest report.

If you never sign in and never run a guest audit, no Talon service cookies are set.

03 What we do not use

• No advertising or marketing cookies.
• No third-party tracking or cross-site cookies.
• No fingerprinting technologies.

We use Cloudflare Web Analytics for site analytics. It is cookieless: it sets no cookies, uses no local storage, persistent identifiers or fingerprinting, and cannot track you across sites — it only reports aggregate, anonymous page views and page-load performance.

Because we only use strictly necessary service cookies — and no cookie-based analytics or tracking — no consent banner is required under the ePrivacy Directive; these cookies are set solely to deliver the service you request.

04 Managing cookies

You can clear or block cookies in your browser settings, and you can sign out to remove the session cookie immediately. Blocking or clearing the session cookie signs you out; blocking or clearing the trial cookie resets the browser-side record of whether the guest audit allowance was used.

05 Changes & contact

If we ever introduce additional cookies, we will update this policy and, where required, request your consent first. Questions: privacy@raptorlabs.dev. See also our Privacy Policy.