Cookies and Browser Storage Notice

Version 7Effective 5 Nov 2026

Cookies, local storage and session storage let our website remember information in your browser. Some support a service you request; others remember optional preferences or measure use. This notice works with our Privacy Notice.

Your choices

Essential storage supports sign-in, security, privacy choices, form progress and access to a requested report. Optional analytics remains off until you agree. Remembered preferences and drafts are enabled when you choose the relevant feature or consent to the category. We apply this consent-based approach worldwide as our product policy.

Use Privacy preferences in the website footer to accept optional storage, reject it or change your choices. Withdrawing is as easy as enabling it. As a voluntary commitment, we treat recognised Do Not Track and Global Privacy Control signals as a rejection of optional analytics. We do not use advertising cookies or third-party advertising trackers.

Storage inventory

Names containing an asterisk have a variable account, report or other identifier. Not every item is used on every page.

Purpose and examplesSupabase sign-in session and any PKCE verifier

Duration and control

For the sign-in session or until sign-out; short-lived verification data is removed after use. Essential for account access.

Purpose and examplesexpandus_guest_session; expandus_report_*

Duration and control

Up to 30 days for access to the requested report or session. Essential to that request.

Purpose and examplesexpandus_email_confirmation

Duration and control

Up to 30 minutes. Essential to email confirmation.

Purpose and examplesexpandus_assistant_visitor; expandus_assistant

Duration and control

Session use; remembered chat lasts up to 90 days only when you request that feature.

Purpose and examplesexpandos.privacy-consent

Duration and control

Until changed or cleared, to remember your privacy choice and its version. Essential.

Purpose and examplesexpandus.origin-consent.v1; expandus.origin.v1; expandus.origin-visit.v1

Duration and control

A remembered business-country preference until changed or cleared; otherwise the current visit. Remembering it is optional.

Purpose and examplesexpandus:guided-visit:v1:*

Duration and control

Current tab session, to preserve form progress. Essential to the form you are completing.

Purpose and examplesexpandus:guided-drafts:v1:*

Duration and control

Up to 30 days and 50 drafts, when a signed-in user chooses to save drafts.

Purpose and examplesSign-in pending-claim, return-path and recovery keys

Duration and control

Minutes to one hour; removed after use. Essential to the sign-in or recovery step.

Purpose and examplesexpandus.campaign

Duration and control

Current session, for campaign attribution; enabled only with analytics consent.

Purpose and examplessidebar_state; expandus_account_appearance

Duration and control

Seven days for the sidebar; appearance until changed or cleared. User-selected display preferences.

Purpose and examplesexpandus.internal.onboarding.v1

Duration and control

Staff interface preference until cleared; relevant only to the staff tool.

Purpose and examplesCloudflare Turnstile pre-clearance (cf_clearance), only if enabled

Duration and control

A security-clearance cookie used when the optional pre-clearance feature is enabled; duration follows the configured challenge-passage period. The standard bot check uses a verification token.

Purpose and examplesMicrosoft Clarity: _clck; _clsk

Duration and control

_clck up to one year, to recognise a returning browser; _clsk up to one day, to group page views into one visit. Set only with analytics consent.

We enforce the stated expiry for local storage in our application; local storage does not expire automatically merely because a period is described here.

Analytics and browser controls

If you allow analytics, two things switch on. Our own aggregate measurement records page category, action, date and count for up to 90 days; these counts do not contain names, stored IP addresses, device identifiers, messages, form answers, full referrers or report links. Microsoft Clarity also records how our informational pages are used, such as clicks, scrolling and movement through the page, so we can find and fix confusing layouts. Clarity masks input-field contents, and we also mask the assistant chat. Masking does not hide page addresses, page layout or interaction events. Clarity is not used on the Snapshot, contact and enquiry forms, saved reports, or signed-in, partner or staff pages, and we do not allow it to use advertising storage. Hosting and security systems may separately process IP addresses and other technical information as described in the Privacy Notice. Campaign attribution is also subject to your analytics choice.

You can remove storage through your browser settings. Blocking essential storage may prevent sign-in, verification, report access or form progress. Clearing a privacy-choice record can cause the website to ask again. Browser deletion does not automatically delete information already submitted to our systems; contact privacy@expandusglobal.com, or hello@expandusglobal.com if necessary, for a server-side data request.