STORMSHIELD · WEBSITE POLICIES

Cookie Policy

Last updated: September 12, 2026

Cookies used for private reports

After you enter your email and report access code, StormShield sets an essential first-party session cookie. It lets the server check your permission each time you open that report or one of its files. It contains an opaque session credential, not your name, email, property address, or roof findings. It is restricted to secure connections on the hosted site and is unavailable to page scripts.

The cookie lasts up to 24 hours per sign-in. Signing out ends that browser session. You can sign in again with the same email and code until the code expires, normally 30 days after creation. Each browser has its own session; signing out of one does not sign out the others. Expiration, deletion, or revocation can end access sooner. Blocking this cookie prevents private report access. Browsing the public pages or submitting a report request does not require a customer report session.

Staff sign-in and Cloudflare

Authorized staff use Cloudflare Access for the separate owner workspace. Access uses essential cookies, including CF_Authorization, for sign-in and request protection. Its sign-in domain and application may use additional security cookies with different lifetimes. These staff cookies are separate from homeowner report access and do not contain the details typed into a StormShield request form. Cloudflare describes them in its Access cookie documentation.

Cloudflare also processes technical request and security information to host and protect the website. Cookie lifetimes and security-log retention are different; see our Privacy Policy.

Tracking, embeds, and the demo

The application has no optional analytics, advertising pixels, session replay, browser fingerprinting, embedded maps, video players, review widgets, or third-party chat widgets. Images are served with the site and it uses system fonts. Outside links load a separate service only when you choose to follow them.

The fictional demo keeps form entries temporarily in page memory and does not write them to cookies, local storage, or session storage. Your browser may independently cache files, provide autofill, or restore a page.

Cookie choices

There is no optional tracking to accept or reject in this pilot, so we do not display a tracking-consent banner. The report session is needed for the private access you request. If optional analytics, advertising, or other nonessential storage is introduced, we will describe its purpose, provider, duration, and applicable choices before enabling it and obtain consent where required.

You can clear or block cookies in your browser settings and use the report’s sign-out control on a shared device. Contact us if you need another way to receive or discuss your report.

Private inspector sessions

The inspection workspace uses a separate essential, first-party session cookie after an inspector enters the assigned email address and private invitation code. The cookie contains an opaque credential, is unavailable to page scripts and is restricted to secure connections on the hosted site. A session lasts no more than 24 hours and cannot outlive its invitation. The same private code can reopen the assigned inspection for up to 30 days, unless access expires or is revoked. Signing out ends that browser’s inspection session. The site stores drafts on the server when you save them; it does not store the invitation code or inspection draft in local storage.