Cookie policy
The two cookies LegitSonar sets, and why there are no others.
LegitSonar sets two cookies. Both are strictly necessary, neither identifies you, and there are no others — which is why you are not being asked to agree to anything.
The cookies this site sets
| Name | Purpose | Lifetime |
|---|---|---|
legitsonar-session |
Holds the session identifier. It is what lets a form submission be tied to the page it came from. It contains no personal data — the identifier points at server-side storage that, for an anonymous visitor, is effectively empty. | 120 minutes of inactivity |
XSRF-TOKEN |
Carries the anti-forgery token, so a form on this site cannot be submitted from another one on your behalf. A security measure, not a tracker. | Same as the session |
Both are SameSite=Lax, so they are not sent when another site links or embeds
this one. The session cookie is HttpOnly, so page scripts cannot read it.
Cookies set by Cloudflare
Traffic reaches this site through Cloudflare, which may set its own cookies — typically
__cf_bm — to tell browsers from bots. These are set by Cloudflare, not by this
application, and are used for abuse prevention rather than advertising. Cloudflare documents
them in its own cookie reference.
What is not here
No analytics cookie. No advertising or retargeting cookie. No social-network cookie. No consent-management cookie, since there is no consent to manage. No third-party script runs on these pages at all: the only external request a page makes is for the web fonts, and that request sets no cookie.
Two consequences worth stating plainly. There is no measurement of how many people use this site or which pages they read. And nothing here can follow you to another site, because nothing here has anything to follow you with.
Refusing them
Every browser can block cookies for a site, and you can block these. The consequence is small and worth knowing: browsing, searching and reading reports all work without them, because those pages ask nothing of the session. Submitting the search form may fail the anti-forgery check, and the live scan may be refused for the same reason.
Clearing them has no effect beyond that — there is no profile to lose, because none was built.