Legal
Cookie Policy
This page lists every cookie the ShortcutDock website can set, who sets it and what it is for. The Mac app is a separate matter and is covered at the end: it is not a browser and it sets no cookies at all.
Every cookie, named
The cookies in full
Two of these are set by Google on public pages. The rest exist only inside the private administrator area and are never set for an ordinary visitor.
| Cookie | Set by | Purpose | Where |
|---|---|---|---|
| _ga | Identifies your browser so repeat visits count as one visitor. Set by Google Analytics. | Public pages | |
| _ga_<measurement id> | Holds the state of your current Google Analytics session for this site. | Public pages | |
| sd_refresh_token | ShortcutDock | Keeps a signed-in administrator session alive. HttpOnly, so scripts cannot read it. | Admin area only |
| adminAuth | ShortcutDock | Carries the admin dashboard sign-in state between page loads. Same-site only. | Admin area only |
| sd_csrf | ShortcutDock | Reserved for request forgery protection. Configured but not issued on public pages today. | Not currently set |
What a cookie is
Cookies are small text files a website asks your browser to store and hand back on later requests. They let a site remember a setting, keep a session alive, or recognise that two page views came from the same browser.
Google Analytics and the _ga cookies
The live website loads Google Analytics using the gtag.js tag served from googletagmanager.com. This is analytics, not advertising, but it is a third-party measurement tool and it does set cookies. It runs on the published site and is switched off in local development builds.
Google Analytics places two cookies in the _ga family:
- _ga stores a randomly generated identifier for your browser, so repeat visits can be counted as one visitor rather than several.
- _ga_<measurement id> holds the state of your current session for the specific property this site reports to.
Through this tag, Google also receives the page you are on, the page that referred you, your IP address and your browser and device details. That is described in our Privacy Policy. Google sets, reads and retains these cookies under its own terms; we cannot delete them on your behalf.
We do not load Facebook Pixel, ad network tags, retargeting scripts or any other advertising tracker, and we do not sell or share the data Google collects.
Cookies we set ourselves
On the public pages you are reading now, our own server sets no cookies. Browsing the site, reading these policies and starting a download all work without one.
Our first-party cookies belong to the private administrator dashboard, which only we can sign in to:
- sd_refresh_token holds the session refresh token for a signed-in administrator. It is HttpOnly, so page scripts cannot read it.
- adminAuth carries the dashboard's own sign-in state between page loads and is restricted to same-site requests.
The site's configuration also reserves a cross-site request forgery cookie named sd_csrf (HttpOnly, same-site, 15 minute lifetime). It is defined but no public page currently issues it, so you will not find it in your browser today. It is listed here so this page stays accurate if that protection is switched on.
We do not use browser local storage or session storage to track you on the public site.
How to refuse or delete them
The site does not depend on Google Analytics, so blocking it costs you nothing. You can:
- Block or delete cookies for this site in your browser settings, using the links below.
- Use a content blocker or a browser that blocks third-party trackers by default.
- Install Google's own opt-out browser add-on, which stops the tag reporting for every site.
Browser instructions:
One thing cookie settings cannot switch off: when you click a download or checkout link, our server records that event, including your IP address. That happens on the server, not in your browser, so no cookie is involved and no blocker can prevent it. The Privacy Policy explains what is recorded and how long it is kept.
The Mac app uses no cookies
Everything above concerns the website. The ShortcutDock desktop application is a native Mac app, not a web page. It uses no cookies, no tracking pixels and no analytics tag, and it does not load Google Analytics. Your shortcuts and preferences stay in the app's own sandboxed storage on your Mac.
Contact us
If something on this page does not match what you see in your browser, tell us and we will correct it. Use the contact form.