Scale Post Cookie Policy

Effective date: August 23, 2026 Last updated: August 23, 2026

This Cookie Policy explains how Danleo LLC (“Danleo,” “Scale Post,” “we,” “us,” or “our”) uses cookies, pixels, local storage, session storage, embedded-media technologies, and similar tools on scalepost.pro and app.scalepost.pro (collectively, the “Sites”).

Our Privacy Policy explains how we process personal data more broadly. Questions may be sent to support@scalepost.pro.

1. What these technologies are

A cookie is a small text file stored by a browser. Cookies may be set by the website being visited (first-party cookies) or by another service whose technology appears on the website (third-party cookies).

Similar technologies include:

pixels and JavaScript tags that send events to analytics or advertising providers;
local storage, which remains in a browser until deleted or expired by application logic;
session storage, which normally lasts until the browser tab or session is closed;
embedded players that contact an external media provider; and
server-side identifiers linked to a browser cookie or advertising click.

The rules applicable to these technologies may be the same even when no conventional cookie is used.

2. Categories we use

2.1 Strictly necessary and security

These technologies are required to authenticate users, prevent request forgery, secure the Service, maintain a requested session, route an authorization flow, or remember the active workspace. The authenticated Service cannot operate properly without them.

2.2 Functional and preference

These remember a choice requested by the user, such as language. They are not used for behavioral advertising.

2.3 Analytics

These help us understand visits, registration steps, and purchases. In the EEA, UK, and other consent jurisdictions, we use them only after valid consent unless a specific legal exemption applies.

2.4 Advertising and attribution

These attribute visits or purchases to campaigns, advertising networks, or referral links and measure advertising performance. They may permit a provider to recognize a browser across websites. We treat them as non-essential and obtain consent where required.

2.5 Embedded media

An embedded player may contact its provider and disclose an IP address and device or interaction data. Where consent is required, the player loads only after the visitor accepts the applicable category or deliberately chooses to load the media.

3. Technology table

Names can vary by environment, browser, provider configuration, or cookie chunking. Provider-controlled durations may change.

Name or technology	Provider	Category	Purpose	Typical duration
`__Secure-authjs.session-token` or `authjs.session-token`	Scale Post	Strictly necessary	Maintains the signed-in session using an encrypted/signed token	Up to 30 days of inactivity under the current default; renewed during use
`__Host-authjs.csrf-token` or `authjs.csrf-token`	Scale Post	Strictly necessary	Helps prevent cross-site request-forgery attacks during authentication	Session or short-lived authentication flow
`__Secure-authjs.callback-url` or `authjs.callback-url`	Scale Post	Strictly necessary	Returns the user to an approved Scale Post page after authentication	Session or authentication flow
`state`, `nonce`, or `pkce` authentication cookies, if generated	Scale Post	Strictly necessary	Secures an OAuth or authentication flow	Normally up to 15 minutes
`activeWorkspaceId`	Scale Post	Strictly necessary / functional	Remembers the project selected by an authenticated user; the server separately verifies ownership	1 year
`locale`	Scale Post	Functional	Remembers the selected language	1 year
`sp_consent` in local storage	Scale Post	Strictly necessary preference record	Records the visitor’s cookie choice on the particular domain	Until changed, browser storage is cleared, or a renewed choice is requested
`sp_ref`	Scale Post	Advertising and attribution	Remembers the referral code associated with a referral link until registration	30 days
`sp_utm`	Scale Post	Advertising and attribution	Remembers campaign parameters and referring host until registration	30 days
`_ga`	Google Analytics	Analytics	Distinguishes browser instances	Up to 2 years, typically refreshed on use
`_ga_G-LQ4XP5XR8Z` or another `_ga_<container-id>`	Google Analytics	Analytics	Persists analytics session state	Up to 2 years, typically refreshed on use
`_fbp`	Meta	Advertising	Identifies a browser for advertising measurement and event matching	Provider-controlled; commonly up to 90 days
`_fbc`	Meta	Advertising	Stores or derives a Meta advertising click identifier after a tagged ad click	Provider-controlled; commonly up to 90 days
Meta Pixel JavaScript and related browser storage	Meta	Advertising	Sends page and funnel events and measures advertising performance	Provider-controlled
Google Analytics JavaScript	Google	Analytics	Sends page, campaign, registration, checkout, and related measurement events	Provider-controlled; associated first-party cookies listed above
Kinescope embedded player and related storage	Kinescope	Embedded media	Streams the landing-page video and measures player operation or interaction	Provider-controlled; may include session or persistent storage
Temporary form-transfer keys in `sessionStorage`	Scale Post	Strictly necessary / functional	Transfers a selected copy or draft publication fields between product screens	Browser tab/session; removed after use where implemented

4. Server-side events and stored identifiers

Some measurement occurs without loading a pixel at the moment of purchase:

when the user begins checkout, Scale Post may read the Google client ID and Meta _fbp/_fbc values already present in the browser and store them with the account; and
after the selected payment provider confirms payment by a server notification, Scale Post may send a purchase event to the analytics or advertising provider for which the user gave the applicable consent.

The Google event may include the client ID, transaction ID, value, currency, and plan. The Meta event may include _fbp, _fbc, purchase information, and a SHA-256 hash of the normalized account email.

We use these events only as permitted by the user’s applicable consent and opt-out choices. Declining or withdrawing advertising or analytics consent prevents future non-essential browser and server-side measurement to the extent required by law.

5. Cross-domain operation

The public website uses scalepost.pro, while registration and the application use app.scalepost.pro.

Google Analytics is configured to measure a journey across the two domains. Campaign parameters may also be copied into links leading from the public site to the application.

Consent is stored separately in each domain’s local storage. Because local storage is not shared across domains, a visitor may be asked for a choice more than once.

6. Payment-provider technologies

When you choose a payment method, your browser may be redirected to a page controlled by the selected payment provider. The provider may set cookies needed for payment security, fraud detection, language, checkout continuity, and its own legally permitted measurement. Its identity and privacy notice are displayed on the hosted payment page before payment is completed.

Those cookies are set on the provider’s domains and are governed by the provider’s cookie and privacy notices. Scale Post does not control their names or durations. Payment-security technologies necessary to complete a transaction may be exempt from consent under applicable law.

7. Your choices

Where the Sites display cookie controls, you may:

accept or decline non-essential technologies;
select categories where granular controls are provided;
later reopen Cookie Settings and change or withdraw consent; and
use browser controls to delete or block stored data.

Rejecting non-essential technologies must be as easy as accepting them. Strictly necessary technologies remain active because the requested Service cannot operate securely without them.

Withdrawing consent does not make prior consent-based processing unlawful. It prevents future use after the choice is received, subject to reasonable technical propagation time.

Blocking all cookies may prevent login, workspace selection, language preferences, checkout continuity, or other core functions.

8. Global Privacy Control and US opt-outs

Where applicable law treats advertising disclosures as a sale, sharing, or targeted advertising, we will treat a recognized Global Privacy Control (GPC) signal as an opt-out for the browser sending it.

You may also email support@scalepost.pro with the subject “Opt Out of Sale/Sharing”. We do not respond to legacy “Do Not Track” signals that lack a generally accepted legal standard, but we honor GPC where required.

9. EEA and UK consent rules

In the EEA and UK, storing or accessing information on a device generally requires prior consent unless the technology is strictly necessary for a service expressly requested by the user or another narrow exemption applies.

Accordingly, where consent is required:

Google Analytics and Meta technologies do not load before consent;
first-party advertising attribution cookies such as sp_utm and sp_ref are not set before consent unless a legal exemption applies;
Kinescope does not load before consent or an affirmative “load video” action; and
the user can later change or withdraw the choice through Cookie Settings.

10. Changes to this Cookie Policy

We may update this Policy when technologies, providers, durations, or law change. We will update the date above and request new consent where a material change requires it.

11. Contact

Danleo LLC 1021 NE 58th Street, Unit 106 Oakland Park, FL 33334 United States Email: support@scalepost.pro

← Back to home