Legal
Cookie Policy
Last updated 12 October 2026.
This site sets no non-essential cookies. No analytics cookies, no advertising, no tracking pixels and no social media widgets. We count visits with a cookieless tool, described below, which you can switch off. That is why you have not been asked to accept anything.
What May Be Set
| Name | Set By | Purpose | How Long |
|---|---|---|---|
__cf_bm |
Cloudflare, our host | Tells people from automated attack traffic. Strictly necessary to protect the site; it holds no identifier that follows you elsewhere. | 30 minutes |
Cloudflare sets this only when its bot protection is switched on for the request. The law allows strictly necessary cookies without consent.
The Bot Check
The sign in form, the security headers checker and the feedback form on tool, quiz and training pages use Cloudflare Turnstile to check you are a person before we send a code, fetch a page or save your note. It runs in a small frame served from challenges.cloudflare.com and reads signals from your browser, such as its type and your IP address. That counts as access to your device, and the law allows it without asking because it is strictly necessary for the security of the service you asked to use. It loads only on those pages, and on tool, quiz and training pages only when you open the feedback form. Cloudflare explains what it collects in its Turnstile privacy addendum.
Counting Visits
We use Cloudflare Web Analytics to count which pages are visited, where visitors came from, their country and browser type, and how quickly pages load. It sets no cookie, stores nothing on your device and does not follow you to other sites or build a profile of you; we see totals, not people. Its script loads from static.cloudflareinsights.com and reports to cloudflareinsights.com. It reads a few details from your browser to do this, so you can switch it off: the choice is kept on this browser only. We also leave it off if your browser sends Global Privacy Control or Do Not Track.
What Member Accounts Keep in Your Browser
These are not cookies but your browser's own storage, and the same rule applies to them. When you sign in, your browser keeps:
| What | Where | Purpose | How Long |
|---|---|---|---|
Your sign in session (sb- followed by our project reference) |
Local storage | Keeps you signed in between pages and visits | Until you sign out or delete your account |
A copy of your quiz progress (gw-quiz-stats-v1, gw-quiz-pending-v1) |
Local storage | Lets the quiz carry on if your connection drops; the copy is sent to your account when you are back online | Until you delete your account or clear your browser |
Which email boxes you ticked (gw-marketing-choice) |
Session storage | Carries your choices from the sign in form to your account once your code is checked | Removed as soon as you are signed in, and when you close the tab |
Your training progress (gw-training-v1: followed by the course and your account
reference) and an assessment in progress (gw-training-attempt-v2) |
Local storage | Shows which lessons you have practised, and lets an assessment you have started carry on after a reload. It holds the questions and your choices, never the answers | Lesson progress until you clear your browser; an assessment until it is marked or you clear your browser |
That you switched off visit counting (gw-analytics-off) |
Local storage, on any visitor's browser, member or not | Remembers your choice so visits are not counted | Until you tick the box again or clear your browser |
All but the last are strictly necessary for the account and training you asked for, and the last keeps a choice you made, so we do not ask first. The other tools store nothing.
The Cookie Notice
A small notice tells you that this site sets no tracking, advertising or analytics cookies. It
asks for nothing. If you close it, your browser keeps gw-cookie-notice-closed in local
storage, holding the value 1 and nothing else, so the notice does not come back. It identifies no
one and is never sent to us. It stays until you clear this site's data in your browser, and then the
notice shows again. Keeping it is strictly necessary to do what you asked, which is to stop showing
the notice, so we do not ask first.
If This Changes
If we ever add a cookie that is not strictly necessary, we will ask first, with a "reject" button as easy to press as "accept", and we will list it here before it goes live.
Questions
Write to legal@greywellcyber.com.