Policies
Cookie Policy
What cookies and browser storage Observer uses, why, and how to manage them.
This page lists every cookie the Service sets, and the other things it stores in your browser, with what each one is for and how long it lasts. It sits alongside the Privacy Policy, which is the canonical document for personal data more broadly.
Summary
- We set only cookies that are strictly necessary (to sign you in, unlock a private status page, or protect a sign-in flow) or that remember a choice you made (a language or layout preference, set only when you make that choice).
- We do not use advertising, cross-site tracking, or third-party analytics cookies on the Service, on the docs site, or on customer status pages.
- We run no analytics or tracking scripts on the Service, the website or customer status pages.
Strictly necessary storage is exempt from the consent requirement under the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy rules. Preference cookies and preference storage are set only as a direct result of you choosing a setting, to provide the setting you asked for. For that reason we do not display a cookie consent banner. If we ever introduce non-essential cookies, we will update this page first and add a banner that lets you refuse them as easily as accept them.
Observer console and website (use.observer)
| Name | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
__session (and __session_* variants) | Clerk, our authentication provider | Carries your signed-in session to the Service | Strictly necessary | Short-lived token, refreshed continuously while you are signed in |
__client_uat (and __client_uat_* variants) | Clerk | Records when your sign-in state last changed, so every tab and page agrees on whether you are signed in. Our website also reads it to show "Open console" instead of "Sign in" | Strictly necessary | Persistent, as set by Clerk; cleared on sign-out |
__client, __refresh_* and other __clerk_* cookies | Clerk (some on Clerk's sign-in domain, clerk.use.observer) | Keep you signed in across visits, refresh your session, and protect sign-in against forgery | Strictly necessary | Session or persistent, as set by Clerk, up to the maximum session lifetime |
obs_console_rail | Observer | Remembers whether you collapsed or expanded the console sidebar. Set only when you change it; sent only to console pages | Preference | 1 year |
Clerk may change the names and lifetimes of its cookies as it updates its session machinery. The rows above reflect Clerk's documentation and our own configuration on the Last updated date. Your browser's developer tools show the current set for the use.observer domain.
Customer status pages
Public status pages, on use.observer subdomains or on a customer's custom domain, set no cookies to a viewer who simply reads the page. The cookies below are set only when the viewer chooses a feature that needs one.
| Name | Purpose | Category | Lifetime |
|---|---|---|---|
obs_status_lang | Remembers the language a viewer picked in the page's language menu | Preference | 1 year |
observer-page-access-<page id> | Keeps a viewer signed in to a password-protected page after they enter the password | Strictly necessary | 1 hour |
observer-page-access-sso-<page id> | Keeps a viewer signed in to a private page after they sign in with Google, Microsoft, or the page owner's identity provider. Holds the viewer's verified email address, signed so it cannot be altered | Strictly necessary | 12 hours |
observer-page-sso-bind, observer-page-sso-tx | Protect that sign-in flow against forgery while it is in progress (one-time state, nonce and verifier values) | Strictly necessary | 10 minutes, deleted when sign-in completes |
observer-page-token | Keeps a viewer who opened a page through a signed access link authorised as they move between that page's views | Strictly necessary | 1 hour |
observer-reliability-<page id> | Keeps a customer contact signed in to a page's reliability portal after they open their personal access link | Strictly necessary | 30 minutes, or until the access link expires if sooner |
All of the cookies above except obs_status_lang are HTTP-only, so scripts on the page cannot read them. If you are signed in to the Observer console, your browser also sends Clerk's cookies to status pages on use.observer subdomains, because they share a parent domain; status pages do not read or use them.
Other browser storage
Some features keep a small value in your browser's local or session storage instead of a cookie. These values never leave your browser.
| Where | What is stored | Category |
|---|---|---|
| Status pages | Whether the viewer switched on automatic refresh; which maintenance banners the viewer dismissed | Preference, set only when the viewer chooses |
| Console and website | Light or dark theme; small layout and progress states (for example, which setup steps you have seen and which banners you dismissed) | Preference |
| Console | A draft of a support request you are typing, so a reload does not lose it; cleared when you send or discard it | Strictly necessary (session storage, cleared when the tab closes) |
Cloudflare
Our content delivery network, Cloudflare, protects the Service against attacks and automated abuse. Where its bot protection applies, or when it asks a browser to pass a challenge, it may set security cookies such as __cf_bm or cf_clearance. They are strictly necessary, are not used for tracking, and last at most as long as Cloudflare sets (for __cf_bm, 30 minutes). Our free status page checker tool uses Cloudflare Turnstile, which runs in a Cloudflare frame to check that a request comes from a person; Cloudflare's own privacy terms apply to it.
What strictly necessary means
A cookie is "strictly necessary" if removing it would prevent a service you have explicitly asked for from working: staying signed in, opening a private status page you have access to, or completing a sign-in safely. Removing them would sign you out or lock you out of the page.
How to manage cookies
You can:
- Block or delete cookies in your browser for use.observer or a status page's domain. Blocking strictly-necessary cookies will sign you out and prevent you from using the console or private pages. Preference cookies can be deleted at any time; the only effect is that the setting resets.
- Use a private or incognito window, which clears cookies and storage when you close it.
- Clear local storage with your browser's site-data controls.
Browser controls live in the privacy settings of Chrome, Firefox, Safari and Edge.
Analytics
We do not run any analytics or tracking script. Nothing on the website, the console or status pages reads or stores information on your device for statistics.
Status pages have their own, separate view counter for the page owner: it counts views per day by country and referring website on our server, sets no cookie, runs no script in the viewer's browser, and stores no IP address. See the Privacy Policy.
Cookies from content customers add to status pages
If a customer adds content to a status page that loads from a third party (for example, custom CSS that pulls in a web font or image hosted elsewhere), that third party may set its own cookies under its own policy. The customer who added it is responsible for that content and those cookies. The Service does not inject any third-party tracking into status pages.
Changes to this policy
We will update this page before we change the set of cookies in use or add a new category. Material changes are also notified as described in the Terms of Service.
Contact
If you have questions about cookies or want to report a cookie we set but have not listed, write to [email protected].