Cookie policy.
Last updated: 20 October 2026
This page lists every cookie scamcanary uses, and everything else we keep in your browser, with what it is for and how long it lasts. In short: only what the site needs to work and to remember your language. No advertising cookies, no tracking cookies and no cookies from other companies. That is why there is no cookie banner.
1. Cookies on the website
lang: remembers whether you read the site in Dutch or English. It is set when you open a page in a language or use the language switch, and lasts one year. That is the only cookie a visitor who is not logged in gets.
2. Cookies when you log in
bettersafe_session: keeps you logged in (the name is from an earlier name of the product). It lasts at most 30 days and is deleted when you log out. bettersafe_2fa: remembers, for at most 10 minutes, that you are halfway through logging in with two-step verification. sc_org: in the dashboard, remembers which company you last had open, for people who look after more than one. It lasts one year. sc_sso: only when you sign in or join with Microsoft or Google, holds for at most 10 minutes the one-time codes that check you are the person who came back from them. sc_m365: only for an admin connecting the Microsoft 365 sync, does the same for at most 10 minutes. None of these can be read by scripts on the page except sc_org, and none is sent to anyone but us.
3. Other things kept in your browser
In the dashboard, your best score in each game is kept in your own browser, so the game can show it straight away; it never leaves your device. Our own team can switch on a setting that stops their visits from being counted; for anyone else it is never set. In the Report a Canary button in Outlook, the button remembers your company's language, and Microsoft's sign-in library keeps what it needs to sign you in to Microsoft 365.
4. Counting visits without cookies
We count visits to the public website ourselves, without a cookie. From your internet address and browser type we make a code that changes every day and cannot be traced back; your internet address itself is never stored. So we can count how many people visited on a day, but not follow anyone from one day to the next. If your browser sends Do Not Track or Global Privacy Control, the visit is not counted at all. The counts are kept for 13 months. The privacy policy has more.
5. Cloudflare
Cloudflare protects our website against attacks. If it suspects traffic is automated, it can place a short-lived security cookie of its own to check you are a person. We do not use that cookie for anything.
6. Why there is no cookie banner
The law asks for your permission before a website stores something in your browser, unless it is needed for something you asked for: in the Netherlands article 11.7a of the Telecommunicatiewet, in the United Kingdom regulation 6 of PECR. Logging in, two-step verification, remembering your language and company, and your game score are all things you asked for, and the visit count uses no cookie. So we only have to tell you, which is what this page is for. If we ever add a cookie that needs permission, we will ask first.
7. Deleting cookies
You can delete or block cookies in your browser's settings. If you block the login cookies, you cannot log in. If you delete the lang cookie, the site picks your language again from the address you open.
8. Questions
Use the contact page. We update this page when what we store changes; the date at the top shows the latest version.