1. Sign-in storage
NamedProof uses the __Host-namedproof_session cookie to maintain authenticated access. It is marked Secure, HttpOnly and SameSite=Lax. Its expiry follows the authentication session; this notice does not promise a fixed number of days. Signing out clears the NamedProof session cookie, not your Google account session.
Blocking essential authentication storage can prevent sign-in and private-workspace access. Google sign-in also loads Google's identity script, which can process browser and connection information under Google's terms. External payment and authentication pages have their own storage practices.
2. Drafts and temporary state
Some forms offer to keep a draft in sessionStorage. Saved onboarding and expert-intake drafts have a 24-hour restoration cutoff; this is not a guarantee that every browser copy is physically erased at that moment. Workspace drafts, pending research and retry identifiers may also remain in sessionStorage without that cutoff.
sessionStorage is associated with a browser tab, but browser session restoration may retain it. Use the form's clear-draft option where available, clear site data, and avoid saving sensitive information on a shared device. A confirmation-cooldown entry contains a timestamp, not your password.
3. Visits, referrals and third parties
Optional first-party analytics starts only if you select “Allow analytics”. It uses a random session identifier stored in this browser tab and records public page routes, the referring site's domain or campaign labels, and approximate time on each page. It does not attach your account name or email and does not keep the full referring URL. Private workspace routes are excluded.
You can change your choice using Analytics settings at the bottom of any page. Rejecting or withdrawing consent stops future analytics events; it does not remove events already recorded. The private administrator report covers up to 90 days, and older event records are removed during analytics cleanup. Hosting access logs are separate and may contain IP addresses and user-agent data under their own retention controls.
Google sign-in, Stripe payment pages and linked social platforms may use their own cookies or storage. A share link takes you to the selected platform; this does not authorize NamedProof to post from your social account.
4. Your choices
Your browser can show, block or delete cookies and site data. Deleting essential storage may sign you out or remove unsent work. Clearing browser storage does not delete server-side account, research, payment or notification records; use the privacy-request contact for those.
For questions about a specific cookie or storage item, email [email protected] with its name and the page where you found it. Do not send its value if it could contain a session token.