This Cookie Policy explains how Sentinel Edge Networks LTD, registered in England and Wales under company number 17150600 ("Maskbreak", "we", "us"), uses cookies, browser storage, scripts, and similar technologies on maskbreak.com and associated subdomains ("the Website").
1. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. Similar technologies include browser local storage, session storage, and JavaScript-based signals used for security purposes. We use these technologies for sign-in, security, requested interface preferences, and product analytics with session recording (§2.5). Local storage, fingerprinting, and pixels are not outside privacy rules simply because they are not traditional cookies.
2. Storage We Use
2.1 Sign-in and interface storage
We use localStorage for sign-in and selected preferences, and sessionStorage for state needed within a browser tab. The purpose and circumstances determine whether an exception to consent applies, not the storage technology. Security functionality and convenience preferences are listed separately below. Local storage has no automatic expiry unless the application or browser removes it.
The browser stores the sign-in JWT; the server stores a token hash, account identifier, IP address and user agent in a session record for authentication and revocation. Server-side session records are separate from browser storage. The short-lived OAuth cookies below bind redirect sign-in to your browser; they do not replace the JWT in localStorage.
| Key and storage | Purpose | Duration | Type |
|---|---|---|---|
__Host-mb_session (cookie) |
Keeps you signed in to the dashboard (your session token). Secure, HttpOnly (page scripts cannot read it) and SameSite=Strict; the dashboard's own requests are accepted with it only when they carry the dashboard's request header. Cleared on logout. Since 14 October 2026. | 30 days from sign-in, or until logout | Essential |
mb_signed_in (cookie) |
Your account number, readable by our pages, so they know you are signed in without reading the session itself: the header shows “Dashboard” and the dashboard keeps its language choice and cached pages per account. It authenticates nothing. Secure and SameSite=Lax. Since 14 October 2026. | The same as the session: 30 days, or until logout | Essential |
sentinel_token (localStorage) |
Held your session token until 14 October 2026; a dashboard tab removes it on its next request once the cookie above is set. A browser that refuses cookies keeps using it to keep you logged in to the dashboard, as before. Cleared on logout. | Token valid for 30 days; the stored entry remains until the cookie replaces it, logout, or browser-data deletion | Essential |
mb_account (localStorage) |
The account number of the signed-in dashboard, so other open dashboard tabs notice a change of account and drop that account's cached pages. It authenticates nothing. | Until browser-data deletion | Essential |
__Host-maskbreak_oauth_g, __Host-maskbreak_oauth_gh (cookies) |
Random security values that bind a Google or GitHub sign-in redirect to the browser that started it. Secure, HttpOnly and SameSite=Lax; used only when you start that sign-in method, not for tracking. | 5 minutes; cleared when the callback is validated | Essential |
__Host-maskbreak_2fa (cookie) |
Random security value that binds a Google or GitHub sign-in awaiting its two-factor code to this browser, so the half-finished sign-in cannot be completed anywhere else. Secure, HttpOnly and SameSite=Lax; set only for accounts with two-factor authentication, not used for tracking. | 5 minutes; cleared when the code is accepted | Essential |
__Host-maskbreak_oauth_ga, __Host-maskbreak_admin (cookies) |
Only set in the browser of Maskbreak’s own operator when signing in to our internal admin console with Google, never for customers or visitors: a random security value that binds that sign-in redirect to the browser (SameSite=Lax), then the admin session itself (Secure, HttpOnly, SameSite=Strict). The admin console also keeps a per-tab proof and the operator’s email address in that tab’s sessionStorage (maskbreak_admin_tab, maskbreak_admin_email), cleared when the tab closes. Strictly necessary for that sign-in; not used for tracking. |
5 minutes for the sign-in value; 12 hours for the admin session, or until sign-out | Essential |
scta_dismissed_v1 (localStorage) |
Remembers that you dismissed the sticky call-to-action bar on product, comparison, use-case and playbook pages so it stays hidden on later visits. | Until cleared | Preference |
mb_mobcta_dismissed (localStorage) |
On blog and resources pages on a phone, remembers when you dismissed the reading bar at the bottom of the screen, so that it stays hidden for 7 days. It holds only that time. | Until cleared (read for 7 days) | Preference |
stl_cmdk_seen |
Remembers that you have seen the dashboard command palette. Older browsers may still hold retired stl_setup_hide, stl_setup_sdk and mb_setup_mode preferences; the console no longer reads or writes them. |
Until cleared | Preference |
mb_lang, mb_console_lang:<account ID> (localStorage) |
Your selected website language and, separately, the console language you explicitly choose for each account in this browser (EN, DE, or ET). New accounts start in English. The account identifier scopes this local preference; it is not sent to an advertising service. | Until changed or cleared | Preference |
mb_last_signin (localStorage), _mb_signin_pending (sessionStorage) |
Remembers which sign-in method you last used successfully in this browser (Google, passkey, password or GitHub) so the log-in page can mark that button “Last used”. It holds only the method name, never your email address, password or any other credential, and it is not sent to us or anyone else. For Google and GitHub redirects the method is held in the tab until the sign-in completes. | Until cleared (replaced at each sign-in); the tab value until the sign-in returns or the tab session ends | Preference |
stl_dash_v1, stl_set_v1, stl_sec_v1, stl_mem_v1, stl_email, mb_console_account (sessionStorage) |
Recent signed-in console responses and your displayed email, so navigating between account pages does not start from a blank screen. This can include account, key, usage, session, or team information available to your account. | Browser-tab session; refreshed or cleared by the application, and cleared on logout | Account |
_sentinel_invite, _sentinel_next, _mb_auth_from (sessionStorage) |
Preserves an organisation invitation and the requested account-page destination while you sign in, and whether a Google or GitHub sign-in started on the sign-up or log-in page, so a failed attempt returns there; removed when consumed. | Until consumed or the tab session ends | Account |
mb_recheck, mb_recheck_at (sessionStorage) |
When the console’s own browser check (“Check my visit now”) stalls, the page reloads once and runs it again; these hold only the time of that reload, so the check resumes after it and never reloads more than once in two minutes. | Removed when the check resumes; the time until the tab session ends | Interface |
mb_ev_page, mb_ev_cols (localStorage) |
Your choices on the console’s Events list (since 17 October 2026): how many rows a page shows and which optional columns are on. Nothing about your visitors. | Until you clear your browser’s site data | Interface |
mb_first_check_auto, mb_guide_on (sessionStorage) |
Whether the console already ran the check on your own browser by itself in this tab session, and whether the “Get started” entry shows in the sidebar of the account pages (since 17 October 2026). | Until the tab session ends | Interface |
pg-auto, sm-human (sessionStorage) |
Avoids repeating the API playground’s automatic demo or an interface animation within the same tab. | Browser-tab session | Interface |
_sntl_sdk_v |
Version marker set by pages that run our security SDK (homepage scanner and IP-lookup tool) so stale security-SDK storage is cleared once after a key rotation. Contains only a version number, or, after the homepage used its fallback network check (§3), a short marker so that your next visit clears the storage that fallback left behind. | Until cleared | Essential |
| Network-check state (localStorage / IndexedDB) | Session state our network check may keep between page loads on the homepage live check, the IP-lookup tool, the contact and public-interest forms and the dashboard, for security and fraud prevention only. It holds opaque values, not your name, email address or account details. | Until cleared | Essential |
_iidt (cookie, HttpOnly, .maskbreak.com), _vid_t (cookie and localStorage), _vid_lr (localStorage) |
Pseudonymous identifiers and state written by our device check (homepage scanner, IP-lookup tool, contact and public-interest forms, and the console’s browser check) so it can recognise the same browser on a later visit, for security and fraud prevention only (§2.2). They hold opaque values, not your name, email address or account details. | Cookies 1 year; localStorage entries until cleared | Essential |
2.2 Security & Fraud Prevention
Security SDKs run on the homepage live check, the IP-lookup tool, the contact and public-interest forms, and the signed-in dashboard (the network check on every dashboard view; the device check only when you run the console’s browser test). They do not run on the sign-up, log-in, password-reset, settings, security or members pages. They process network signals (such as IP address, connection type, VPN/proxy status) and device signals (such as browser characteristics, tampering, and automation indicators) to authenticate users, prevent abuse, and provide a security feature the visitor or customer requested.
These technologies are used only for security and fraud-prevention purposes, not advertising. The homepage scanner starts automatically with a network-only pass. Deeper device intelligence starts when the scanner is visible or the visitor interacts with it; because the scanner is near the top of the homepage, this can happen immediately. More detail about lawful bases, recipients, and retention is in our Privacy Policy.
We also check passwords against the Have I Been Pwned breach database when you sign up, reset or change your password. Only a partial hash of the password is sent (k-anonymity) — your actual password is never transmitted.
If you wish to object to this processing under GDPR Article 21, please contact us at support@maskbreak.com. Note that objecting may prevent you from using certain features of the platform.
2.3 Analytics and advertising
We set no advertising cookies and do not run Microsoft Clarity, Google Analytics or retargeting pixels. Since 23 September 2026 we run PostHog product analytics with session recording on public pages, sign-up and the dashboard, without a consent prompt, as described in §2.5. There is no chat widget on our pages any more: the Widgo chat was removed on 30 September 2026 (§2.4).
Google Ads measurement is disabled as of 6 September 2026. The advertising tag, its queued configuration, conversion-event calls, and connection hints have been removed from public pages, signup, and the dashboard, including the page generators. Google Sign-In remains available as a separate authentication option.
Before this change, Google Ads ran with its consent settings denied but could still send cookieless measurement pings. Those pings could include request and device information; they were not equivalent to “no data collected”. Disabling the tag prevents new tag-generated measurement from the updated pages; it does not retrospectively erase information already received by Google. We will not reintroduce advertising technology without updating this notice. Product analytics returned on 23 September 2026 with PostHog (§2.5); it starts without a consent prompt, and browsers that send Global Privacy Control or Do Not Track are not measured.
2.4 Former chat providers
We removed the Widgo chat on 30 September 2026. From 22 September 2026 until then, its launcher loaded by itself on public marketing pages (not on sign-in, private account or result pages; browsers that sent Global Privacy Control, or were signed in to the Maskbreak console, got a button instead). No page loads it now, and our Content Security Policy no longer allows its hosts. Email support@maskbreak.com for help.
While it was loaded, Widgo processed request IP, browser/device characteristics, pages, referrer and campaign information and interaction timing, and, if you wrote to it, chat content and volunteered contact details. Identifiers it created before the removal can remain in your browser until they expire or you clear site data: widgo_sid in cookies (up to one year) and localStorage, widgo_verified_<organisation> cookies (up to 400 days) and localStorage, cache entries with the widgo_cfg_ and widgo_gone_ prefixes, and session entries such as widgo_closed_on. We no longer read or set any of them. Chat transcripts and records Widgo already holds are not deleted by the removal; Widgo’s privacy policy describes its retention, and you can email us for access or deletion requests.
Earlier provider: Crisp was replaced on 8 September 2026. Its existing crisp-client/ cookies and historical support records are not deleted by switching providers; clear site data or contact us as above. The old mb_chat_open preference no longer starts any chat.
2.5 Product analytics and session recordings (PostHog)
Since 23 September 2026 we use PostHog to see how people use maskbreak.com: which pages they view, what they click, and recordings of how a page was used, so that we can find what confuses visitors and where sign-up and setup fail. It starts by itself, without a consent prompt, once a page has finished loading. It runs on public pages, /signup and the dashboard. It never runs on sign-in, password-reset, verification, invitation, settings, security (including two-factor), members, admin or result pages, on a page whose address carries anything other than campaign parameters, or inside another site’s frame. It does not start at all if your browser sends Global Privacy Control or Do Not Track, or asks to save data.
What is recorded. Page views and page leaves (the address keeps only utm_* and ref campaign parameters, and an IP address in a page path is replaced), clicks with the text and position of what was clicked, the referring page, browser, operating system, device type and screen size, and a session recording: the page’s layout and visible text, mouse movement, scrolling, clicks and window size, rebuilt as a video-like replay. Since 17 October 2026 also page-speed measurements (Core Web Vitals: how long the page took to show its main content and to respond to a tap or click, and how much its layout shifted) and, on public pages and /signup, clicks that changed nothing on the page and errors in the page’s own scripts (the error type, message and code location, with addresses in them cleaned like page addresses). PostHog also receives the IP address of each request and can derive an approximate location from it. One random identifier follows a browser from public pages through sign-up into the dashboard.
What is masked or left out. Everything typed into a form field, including passwords, codes and your email address at sign-up, is masked in the browser before anything is sent. So are the homepage live check, the IP-lookup results, the API playground and the email address shown while you confirm sign-up, because they show your own IP address, network, location, verdict or email; clicks inside them are not captured, and the verdict panels appear as blank boxes in recordings. On the dashboard all text and attribute values are masked, so a recording shows the layout and where you clicked but not your API keys, signing secrets, email address or your visitors’ data, and the charts, event map and flags are left out. Console logs, network requests and their timings, request headers and bodies, and canvas content are never recorded, and no dead clicks or script errors are sent from the dashboard. We do not send PostHog your name, email address, account ID or API keys, and we do not create a named profile of you.
How it is loaded. The PostHog library (version 1.434.11) is served from maskbreak.com, not from PostHog. Our Content Security Policy lets the page send data to PostHog’s two EU hosts, eu.i.posthog.com (events and recordings) and eu-assets.i.posthog.com (project settings), but not load code from them, so PostHog cannot run new code on our pages. Data goes to PostHog EU Cloud, hosted in Frankfurt, Germany; PostHog, Inc. is a US company.
The library stores the following in your browser. <key> is our PostHog project key, phc_uc3uxaAkJMw67jkS6B8NFXxoDwRHYjXniGeDB3hQAzKY.
| Key and storage | Purpose | Duration | Type |
|---|---|---|---|
ph_<key>_posthog (cookie on .maskbreak.com, Secure, SameSite=Lax) |
A random identifier for this browser and the current session, so page views, clicks and recordings from the same browser can be grouped. | One year, renewed on each visit; a session ends after 30 minutes without activity or after 24 hours | Analytics |
ph_<key>_posthog (localStorage) |
The same identifier and session state, kept in step with the cookie. | Until cleared | Analytics |
ph_<key>_posthog, ph_<key>_session_registered_properties, ph_<key>_window_id, ph_<key>_primary_window_exists (sessionStorage) |
Tab-level state: which tab a recording belongs to and properties for the current session. | Browser-tab session | Analytics |
dmn_chk_<random> (cookie) |
A test the library writes to find which domain it may set its cookie on. | At most 3 seconds; removed straight away | Analytics |
Your choices. Turn on Global Privacy Control or Do Not Track in your browser, or block eu.i.posthog.com or /assets/analytics.js with a content blocker; any of these keeps PostHog from loading from then on. None of them deletes what was already stored or sent: clear the site data for maskbreak.com to remove the identifiers, and email support@maskbreak.com to object or to ask for access or deletion (the value of your ph_<key>_posthog cookie helps us find your data). PostHog keeps events for up to one year and recordings for up to 30 days on its free plan, longer on paid plans. PostHog’s privacy policy describes its own processing.
3. Third-Party Services
The following third-party services are integrated and may process data from your device:
| Provider | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Network intelligence provider | Network-layer fraud detection: VPN, residential proxy, datacenter, and Tor exit detection. Powers the core /v1/evaluate endpoint. On our pages its SDK loads from a maskbreak.com subdomain. Since 25 September 2026, when that subdomain cannot be loaded on the homepage or does not answer within a few seconds (some iPhones cannot reach it), the homepage check also loads the SDK from the provider’s own domain inside a hidden frame on maskbreak.com and uses whichever answers first; the page clears the SDK storage left by the other host before that load, and your next visit to the homepage or IP-lookup tool clears what the fallback left behind. |
IP address, ASN and connection measurements; basic browser characteristics its script reads (user agent, languages, time zone, window size, processor count, automation flag); the encrypted token it returns. United States | Named to customers under DPA, and to anyone asking who received their data |
| Device intelligence provider | Device-layer intelligence: browser tampering, antidetect detection, bot/automation, emulator/VM, incognito. Loaded from a maskbreak.com subdomain; if that load is blocked, the device check is skipped (our pages do not load it from the provider’s own domain). |
Browser/device characteristics, IP address, pseudonymous identifiers and security signals. United States | Named to customers under DPA, and to anyone asking who received their data |
| Cloudflare | CDN, DDoS protection, and DNS for maskbreak.com; since 20 October 2026 also our application hosting (Containers, Eastern North America: our server and its logs, kept 7 days; server-side only); since 19 October 2026 also our email delivery (Email Service: the recipient’s address and the message; server-side only) and our primary database (D1, in the United States; server-side only); since 17 October 2026 also R2 storage for our encrypted nightly database backups, in Cloudflare’s EU jurisdiction (each copy removed after 40 days, within a 60-day commitment that a daily audit checks; server-side only). Cloudflare may set __cf_bm for bot management (expires after 30 minutes of inactivity) and cf_clearance to remember a passed challenge (duration depends on the challenge-passage configuration). These are not necessarily session-only cookies. |
IP address, request metadata, TLS handshake fingerprint | cloudflare.com/privacypolicy |
| Railway | Application hosting and runtime infrastructure in the United States (US East) until 20 October 2026, keeping our application logs for up to 30 days; since then a stand-by copy of our server without traffic, removed by 27 October 2026. | Server logs, IP address | railway.com/legal/privacy |
| Turso | Our managed cloud database (libSQL) in the United States (AWS us-east-1) until 19 October 2026; the database was deleted with our account the same night, and copies in Turso’s own backups follow its retention terms. Stored account and session records, API keys, evaluation and address-lookup records, newsletter subscriptions, and keyed abuse-prevention counters. | Server-side data only — does not interact with your browser | turso.tech/privacy |
| Amazon Web Services (S3) | Our backup store until 16 October 2026: it holds the encrypted nightly database backups made up to then, EU Stockholm region (eu-north-1), under a 60-day retention commitment that the daily audit confirmed from 10 October 2026. The account is suspended and we are not restoring access to it, so we can no longer check or delete those copies ourselves. | Server-side data only — does not interact with your browser | aws.amazon.com/privacy |
| Resend (former) | Our email provider until 19 October 2026 (Cloudflare since): it delivered verification codes, password resets, security notices, form receipts, account setup emails, monthly summaries, newsletter confirmation emails and the newsletter. Our account was closed the same night; copies Resend may still hold in its own backups follow its retention terms. | Recipient email address and message content, including information you submit in a support or programme application | resend.com/privacy |
| Stripe | Payments, invoices and receipts for paid plans (since 30 September 2026). Checkout and the billing portal open on Stripe’s own website when an account holder chooses them in the console; Stripe’s cookies and similar technologies there are governed by Stripe’s own policies. No Stripe script, cookie or other storage is placed on maskbreak.com pages. | On Stripe’s pages only: email address, plan, payment and billing details, IP address and browser details. Card details never reach Maskbreak’s servers | stripe.com/privacy |
| Widgo (former) | Public-page AI chat and visitor analytics from 22 to 30 September 2026; removed on 30 September 2026 and no longer loaded on any page (Section 2.4). | Records it already holds: chat content, volunteered contact details, IP, browser/device identifiers, page/referrer/campaign data and interaction timing | Widgo privacy policy |
| PostHog | Product analytics and session recordings on public pages, /signup and the dashboard since 23 September 2026, without a consent prompt; not under Global Privacy Control, Do Not Track or Save-Data (Section 2.5). The library is served from maskbreak.com; PostHog EU Cloud (Frankfurt) receives the data. |
Pages viewed, clicks, referrer, browser/device type, IP address, a random browser identifier, and session recordings with form fields, the visitor’s own network readouts and all dashboard text masked | PostHog privacy policy |
| Sentry | Error reports from our server software since 24 September 2026, stored in Sentry’s EU region (Frankfurt). Runs only on our server: nothing is loaded in your browser or stored on your device. | Server-side error details only — request headers, cookies, bodies, query strings, IP addresses, email addresses, keys and tokens are removed before sending (pattern-based: a strong safeguard, not a guarantee) | Sentry privacy policy |
| Google Sign-In (OAuth) | Optional "Sign in with Google" authentication. On /login, Google’s sign-in client also loads by itself after the page has loaded to offer its “Continue as …” prompt (One Tap, sign-in to existing accounts only), except for browsers that send Global Privacy Control or Do Not Track; Google may read or set its own cookies on accounts.google.com when it does. Maskbreak sets no cookie for it. |
Email, name, Google account ID | policies.google.com/privacy |
| Google Workspace | Hosts our support@maskbreak.com mailbox: emails you send us, the contact and programme forms relayed to it, and our replies. | Server-side data only — does not interact with your browser | policies.google.com/privacy |
| GitHub Sign-In (OAuth) | Optional "Sign in with GitHub" authentication, where enabled and offered on the sign-in and sign-up pages. Used only when you choose that sign-in method. (Separately, our nightly backup job runs on GitHub Actions; it does not interact with your browser — see the Privacy Policy.) | Email, name, GitHub account ID | docs.github.com — privacy statement |
| Auth0 (Okta) (former) | Optional emailed sign-in link, offered until 5 October 2026 and removed since: no page or server route contacts Auth0 now. | None any more: we deleted the Auth0 tenant on 6 October 2026, with the user records (email address, sign-in metadata) it held from earlier use; any copies left in Auth0’s own backups are removed under Auth0’s retention terms | auth0.com/privacy |
| flagcdn.com | Flag images in the dashboard’s test panel, requested by your browser when a console test result is shown. Sets no cookie for us. | IP address, browser details and the two-letter country code of the test result | Not published by the provider |
| Have I Been Pwned | Password breach check when you sign up, reset or change your password, using k-anonymity. Our server sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned; your password and the rest of the hash never leave our infrastructure. | Partial password hash prefix only | haveibeenpwned.com/Privacy |
Our specialised detection providers are listed by category: the composition of our detection stack is confidential security information. Customers can request the full named list, with each vendor's privacy policy, under their Data Processing Agreement — published self-serve at maskbreak.com/dpa — by emailing support@maskbreak.com; countersigned copies are available from the same address.
4. How to control storage
4.1 Browser settings
You can clear localStorage and cookies via your browser's developer tools or settings. Note that clearing the __Host-mb_session cookie (or, in a browser that refuses cookies, sentinel_token) will log you out of the dashboard. Clearing site data also removes the PostHog identifiers in §2.5. Instructions for major browsers:
5. International Transfers
Our application hosting (Cloudflare, Eastern North America, since 20 October 2026; Railway, US East, before) and database (Cloudflare D1, Eastern North America, since 19 October 2026; Turso, AWS us-east-1, before) are in the United States, and so are our network- and device-intelligence providers and GitHub. Some other providers, including Cloudflare, Resend (until 19 October 2026), flagcdn.com, PostHog (a US company; our analytics data is hosted in its EU region, but its data processing agreement allows processing elsewhere, including the US), Sentry (a US company; our server error reports are stored in its EU region, but its data processing agreement allows processing in the US), Stripe (payments for paid plans, on its own pages), and Google or GitHub Sign-In, may process data outside the UK and European Economic Area. Where required, we use an applicable adequacy regulation or contractual safeguards. See our Privacy Policy or contact us for more information.
6. Your rights
Information about access, correction, deletion, restriction, portability, objection, automated profiling, and complaints is set out in our Privacy Policy. Rights requests can be sent to support@maskbreak.com.
7. Changes to This Policy
We may update this Cookie Policy when our technology or legal obligations change. Material changes will be highlighted on the Website or sent to account holders where appropriate. The "Last Updated" date at the top reflects the most recent revision.
8. Contact
134a West Hendon Broadway, London, NW9 7AA, United Kingdom · Company number: 17150600