Cookies
Cookie Policy
A cookie is a small file a website stores in your browser; local storage is the same idea with more room. UK law (the Privacy and Electronic Communications Regulations) says we need your consent for any of them that are not strictly necessary for something you asked for. This page lists every one used by this website (www.broadpaper.com, with the demo and documentation under it) and by BroadPaper Cloud (app.broadpaper.com). It is short because there are few.
1. This website — strictly necessary
These do not need consent because the site cannot do what you asked without them.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
bp_consent | This site | Remembers whether you accepted or declined optional cookies, so the banner does not ask again. Also mirrored to local storage. | 180 days |
__session | Clerk | Carries your signed-in session, and is what the account page sends to our account API to prove who you are. Only set once you sign in. | Session |
__client_uat | Clerk | Records that a session exists, so a page can tell whether to show you signed in before Clerk’s script has finished loading. Only set once you sign in. | 1 year |
broadpaper-demo-template-v2:* (local storage) | The demo | The report you are editing in the demo, one draft per starting point, so you can leave and come back. Never sent to us. | Until you clear it or press Reset |
broadpaper-demo-scenario (local storage) | The demo | Which starting point you last had open. | Until you clear it |
2. This website — analytics, off unless you turn them on
We use Microsoft Clarity to see which pages help and where people get stuck: page views, clicks, scrolling, and a replay of the session with text and form fields masked. None of it is used for advertising, and we do not sell it.
Nothing in this category is loaded until you turn on Analytics in the cookie banner. Until then the script is never requested and none of these cookies exist. If you decline, or turn analytics off later, we stop the recording and delete the two cookies set on this domain.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_clck | This site (Clarity) | A random id for your browser, so repeat visits count as one person rather than several. | 1 year |
_clsk | This site (Clarity) | Joins the pages you view into a single session. | 1 day |
CLID | clarity.ms | Identifies the first time Clarity saw this browser. | 1 year |
MUID, MR, SM, ANONCHK | Microsoft domains | Microsoft’s own identifiers, set by the Clarity script. ANONCHK records whether the identifier may be used for advertising; we set advertising storage to denied, so it is not. | 10 minutes to 1 year |
We can delete the first two, because they are set on this domain. The rest belong to Microsoft and are removed through your browser or Microsoft’s own controls; the link is in Microsoft’s privacy statement.
3. BroadPaper Cloud
BroadPaper Cloud uses only strictly necessary storage, and no analytics, advertising or session recording of any kind — which is why it shows no cookie banner.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
__session | Clerk | Carries your signed-in session, and is what the application sends to the Cloud service to prove who you are. May carry a short suffix. | Session |
__client_uat | Clerk | Records that a session exists, so the application knows whether to show you signed in. May carry a short suffix. | 1 year |
broadpaper.sidebar.open (local storage) | BroadPaper Cloud | Which folders you left open in the sidebar, so the tree does not collapse every time you move between screens. Never sent to us. | Until you clear it |
broadpaper.sidebar.sort (local storage) | BroadPaper Cloud | How you chose to sort the sidebar. Never sent to us. | Until you clear it |
msal.* (session storage) | Microsoft’s sign-in library | The state of a OneDrive sign-in while its window is open; no token. Only set once you press the OneDrive button. | Until the tab closes |
Two things BroadPaper Cloud deliberately does not store:
- Google and Microsoft sign-ins. When you bring in a file from Google Drive or OneDrive, the access token is kept in the memory of the tab and never written to a cookie or to your browser’s storage, so it is gone when you close the tab. Google’s and Microsoft’s own sign-in windows and pickers set cookies on their own domains, under their own policies.
- Anything about the people you share with. The page a share link opens (
app.broadpaper.com/s/…) sets no cookies and uses no browser storage, and does not load Clerk. A password typed there is held only while the page is open.
4. Third parties
With analytics off, the website loads no third-party scripts at all: fonts, images and code are served from this site. Turning analytics on loads the Clarity script from clarity.ms and sends what it records to Microsoft, who process it as our processor and may transfer it outside the UK under their standard contractual clauses. That is the only third-party script the website has for visitors who are not signing in.
Signing in — on the website’s account page or in BroadPaper Cloud — loads Clerk’s script from clerk.broadpaper.com, which sets the cookies listed above and keeps a session on that domain as well. Clerk act as our processor; their current list of cookies is in Clerk’s documentation. Whichever identity provider you sign in through sets its own cookies on its own domain, governed by its own policy. The website’s marketing pages, the demo and the documentation load no Clerk script at all.
In BroadPaper Cloud, Google’s sign-in and picker scripts (from accounts.google.com, apis.google.com and docs.google.com) are loaded when you open the screen for bringing in data, so that the Google Drive button can open its window straight away; Google receives your IP address and browser details when they load, as with any request to Google. Microsoft’s sign-in (login.microsoftonline.com) and the OneDrive picker (onedrive.live.com, or your organisation’s SharePoint) are contacted only when you press the OneDrive button.
5. Changing your mind
Press Cookie settings in the footer of any page of the main website to see or change your choice. The demo and the documentation have no such button because they load no analytics; the choice made on the main website applies to them. You can also delete bp_consent in your browser, and the banner will ask again. There is nothing to choose in BroadPaper Cloud, because everything it stores is strictly necessary.
Blocking all cookies in your browser will not break the marketing pages or the documentation; it will stop sign-in working, on the account page and in BroadPaper Cloud, and will make the demo forget your draft and Cloud forget its sidebar between visits. Blocking third-party cookies may stop the Google Drive and OneDrive pickers opening.
6. More
How we handle the data these cookies involve is in the privacy policy. Questions to the address in the margin.