Cookie policy
Every cookie we set, by name, what it is for, and how long it lasts. The list below is the complete one.
Last updated
A cookie is a small piece of text a website asks your browser to keep and send back on the next request. UtilitySpaces uses them for one thing above all: knowing that the browser asking for your workspace is the browser that signed in. Everything in the first table below is strictly necessary — without it, signing in or loading a workspace does not work. Nothing in it tracks you across other websites. The second table is the analytics set, and none of it is set unless you accept it.
Strictly necessary — set without asking
These are exempt from the consent requirement because the service you asked for does not function without them. There is no way to switch them off and still sign in.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
__Host-utilityspaces_session | UtilitySpaces (first party) | Signed-in session. HttpOnly, Secure, SameSite=Lax | 30 days (7 days after single sign-on) |
utilityspaces_session | UtilitySpaces (first party) | The session cookie's previous name. Never set any more: an existing one is read and moved to the name above | Left to expire on its own, or removed at your next sign-in or sign-out |
__Host-utilityspaces_mfa, utilityspaces_mfa (previous name) | UtilitySpaces (first party) | A two-step sign-in in progress: ties the code you enter to the password step you just passed. HttpOnly, Secure | 5 minutes |
utilityspaces_mfa_intent | UtilitySpaces (first party) | What that sign-in was also asked to do (accept an invitation or join code), finished once the code is verified. HttpOnly, Secure | 5 minutes |
utilityspaces_sso | UtilitySpaces (first party) | Anti-forgery state during a single sign-on through your organisation's identity provider. Sent only to the sign-on callback. HttpOnly, Secure | 10 minutes |
__Host-utilityspaces_operator_return, utilityspaces_operator_return (previous name) | UtilitySpaces (first party) | Set only in UtilitySpaces staff browsers: keeps a staff member's own session while they act as a customer account for support, so ending that returns them to their own. HttpOnly, Secure | 30 minutes |
utilityspaces_workspace | UtilitySpaces (first party) | Remembers which workspace you were last viewing. HttpOnly, Secure | Session |
utilityspaces_recent_workspaces | UtilitySpaces (first party) | Recently visited workspaces, for the switcher | Session |
utilityspaces_google_workspace_oauth_state | UtilitySpaces (first party) | CSRF state during a Google connector authorisation. HttpOnly, Secure | 10 minutes |
embed_ticket | UtilitySpaces (first party) | Authorises one embedded-app view. Scoped to that view's path only | Session |
__cf_bm, Turnstile cookies | Cloudflare, Inc. | Bot management and captcha | Set by Cloudflare |
Analytics — set only if you accept
These are set on the public marketing pages only, only once you have pressed Accept all, and never inside a workspace. If you choose Essential only, or ignore the banner, not one of them is written.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_<id> | Google (Analytics 4, via Tag Manager) | Tells one browser from another so a visit can be counted once | 2 years (Google's published lifetime) |
_clck, _clsk, CLID, MUID | Microsoft (Clarity, via Tag Manager) | Ties the events of one session together for the session recordings and heatmaps described below | _clsk one day; the others up to a year (Microsoft's published lifetimes) |
_cltk | Microsoft (Clarity) | Session identifier for the same recording. sessionStorage, not a cookie — it dies with the tab | Until the tab closes |
utilityspaces_referral | UtilitySpaces (first party) | Set only when you arrive through a link from one of our partners and have accepted cookies. Holds that partner's referral code, nothing about you, so that if you later subscribe the partner is credited. It is passed to our payment processor with that checkout and nowhere else | 60 days |
Both providers are listed on our sub-processors page with what each one receives.
Set only when you ask for it
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
us_internal | UtilitySpaces (first party) | Written only when a page is opened with ?internal=1, which is how our own team keeps its browsers out of the analytics. Holds 1; while it is present no analytics tag fires in that browser. ?internal=0 removes it | 1 year |
What each of them actually does
Session and workspace cookies
__Host-utilityspaces_session holds your session token. It is HttpOnly, so page JavaScript cannot read it; Secure, so it only travels over HTTPS; and SameSite=Lax, so another site cannot cause your browser to send it. What we store on the server is a SHA-256 hash of the token, never the token itself, so a copy of our database does not hand anyone a working session. It lasts 30 days, and resetting your password revokes it server-side immediately.
utilityspaces_workspace and utilityspaces_recent_workspaces exist so that opening the product puts you back where you were and the workspace switcher shows the ones you actually use. They hold workspace identifiers, nothing else, and they disappear when you close the browser.
Security cookies
__Host-utilityspaces_mfa and utilityspaces_mfa_intent exist only between the password step and the code step of a two-step sign-in: the first links the code you type to the sign-in you started, the second remembers an invitation or join code you were accepting. Both expire after five minutes and are deleted as soon as the code is verified. utilityspaces_sso does the same job for single sign-on, carrying the anti-forgery state that proves your identity provider's answer belongs to the sign-in you started.
utilityspaces_google_workspace_oauth_state lives for the minute or two it takes to authorise a Google connector. It carries the anti-CSRF state value so we can prove the response coming back from Google belongs to the request you started, and it is discarded as soon as the connection completes.
embed_ticket authorises a single embedded-app view and is scoped to that view's path, so it cannot be replayed against anything else in the product.
Cloudflare
Our site sits behind Cloudflare, which provides the CDN, DDoS protection and the Turnstile captcha on our anonymous forms. Cloudflare sets __cf_bm and its Turnstile cookies to tell a person from a bot. We do not control their contents or lifetimes; they are described in Cloudflare's own cookie documentation. Turning them off is not an option we can offer, because they are what keeps the sign-in page from being brute-forced.
What the analytics tags actually do
Analytics cookies are set through Google Tag Manager only on the public marketing pages, only after you consent, and never inside a workspace. If you decline, or simply ignore the banner, no analytics cookie is written — the tags run in Google's consent mode with every storage permission denied until you say otherwise. Nothing about your workspace content, your messages or your agents is ever measured.
Google Analytics 4 counts page views and where visitors arrived from. Google states that Analytics 4 does not log or store individual IP addresses; it reads the address to derive a coarse location and discards it.
Microsoft Clarity is more than a counter and we would rather say so plainly: once you accept, it records your session on the marketing pages— mouse movement, scrolling, clicks and the pages you moved between — and aggregates those into heatmaps. It is how we find the parts of a page where people get stuck. It runs on the marketing site only — it is never loaded on a signed-in workspace page, so it cannot see your messages, files or agents — and it is configured to mask what you type, so form contents are not captured in a recording. If you would rather not be recorded, choose Essential only — nothing about the site behaves differently.
Your consent choice is not stored in a cookie. It lives in your browser's localStorage under the key utilityspaces-consent, which means it never travels to our servers on any request. When you press a button on the banner we do count the decision itself — two integers, one per button, with no cookie and no identifier attached — because otherwise we would have no honest idea what share of visitors our analytics actually represent.
One thing that runs before you choose
Cloudflare, which serves this site, adds its own Web Analytics beacon (static.cloudflareinsights.com) to every page at the edge, before our consent gate can reach it. We are naming it here rather than leaving you to find it in a network log. It sets no cookie and stores nothing on your device — it reports page-load timings and a page URL to Cloudflare, which is why it is not part of the consent banner above. It is described in Cloudflare's own documentation.
Changing your mind
Withdrawing consent has to be as easy as giving it, so it is the same one click. This button forgets your stored choice, tells any tag already on the page that consent is denied as of now, and brings the banner back so you can choose again.
- Withdraw analytics consent: press the button above. Clearing site data for this domain in your browser does the same thing, by removing the
utilityspaces-consententry. - Block cookies entirely: every browser lets you do this in its privacy settings. Be aware that blocking the strictly necessary cookies above means you cannot stay signed in — the product will not work.
- Do Not Track: we do not load analytics without consent in the first place, so there is nothing extra for a DNT header to switch off.
Local storage, for completeness
Besides the consent key, the product keeps some interface state in your browser — things like which panel you had open, your theme choice, and the language you picked (utilityspaces-language). That is localStorage, not cookies: it is never sent to us, and clearing site data removes it.
Changes
If we add a cookie, it gets added to the table above and the date at the top of this page moves. This page is the list, not a summary of one. For the wider picture of what we hold and why, see the privacy policy.