Legal
Cookies and local storage
Last updated: 7 August 2026
This policy covers everything 99 Data Rooms stores on your device, not just cookies. The law that applies here (Regulation 6 of the Privacy and Electronic Communications Regulations) treats browser local storage the same way it treats cookies, because what matters is that something is stored on your equipment, not which technology does the storing.
We set no first-party cookies
99 Data Rooms itself sets no cookies. Signing you in uses your browser's local storage instead, which is why you will not find a 99datarooms.com cookie in your browser settings.
What we store on your device
All of the following is either strictly necessary to provide the service you asked for, or a preference you set yourself. None of it is used for advertising, profiling, or tracking you across other websites, so none of it requires a consent banner.
| What | Where | Why | How long |
|---|---|---|---|
sb-*-auth-token | Local or session storage | Keeps you signed in. This is the session itself, so without it you cannot use the app. | Until you sign out, or until the tab closes if you did not choose to stay signed in |
dr-keep-signed-in | Local storage | Remembers whether you chose to stay signed in, so we know which of the two stores above to use. | Until you clear it |
app-theme | Local storage | Remembers whether you chose the light or dark theme. | Until you clear it |
dr-room-prefs:* | Local storage | Remembers your room tab order and preferences inside the app. | Until you clear it |
dr-consent-logged:* | Local storage | A one-time marker so we record your terms acceptance once rather than on every sign-in. | Until you clear it |
dr.legal.panel.* | Local storage | Remembers which panels you had open in the document drafting workspace. | Until you clear it |
99dr.visit.* | Session storage | Lets someone viewing a shared document reload the page without losing their place or being asked to verify their email again. | Until the tab closes |
Analytics, without cookies
On our public marketing pages we use GoatCounter and Cloudflare Web Analytics, two privacy-first analytics tools that count aggregate page views and page-load performance without setting any cookies and without storing anything on your device. Neither builds a cross-site profile, uses advertising identifiers, or shares anything with ad networks, and we never run analytics or trackers on document viewers, only on these public pages. Because they store nothing on your device, there is nothing to consent to and no banner to dismiss.
Being plain about what they do receive: like any web request, each counting request carries your IP address, which is used to answer it and to filter automated traffic. Neither tool is sent the page's query string. We do not use your address for anything else, and it is never combined with a profile of you.
We never run analytics or trackers on document viewers. If you are reading a document someone shared with you, no analytics script runs on that page at all. The person who shared it does see page-by-page visit analytics for their own link, which is a core feature of the product described in our Privacy Policy, not something a cookie does.
Third-party services that may set their own cookies
Two parts of the service are provided by other companies, and they may set their own strictly necessary cookies on their own domains when you use those specific features.
- Cloudflare Turnstile protects our sign-in and sign-up forms from automated abuse. It may set a short-lived cookie to remember that a challenge has already been passed. This is a security control, and the service cannot safely be offered without it.
- Paddle handles payments and is the merchant of record. On our pricing and checkout pages Paddle loads its own script and may set cookies necessary to process a transaction and prevent payment fraud. Paddle decides how it uses that data as an independent controller. See our sub-processor register.
No advertising or cross-site trackers
Beyond the cookieless page-view analytics described above, we do not use advertising pixels, session recording, device fingerprinting, or any cross-site tracker, anywhere on the marketing site or inside the product. That is a deliberate part of building a tool you can trust with confidential documents.
Managing what is stored
You can clear site data, cookies and local storage in your browser settings at any time, and you can block them for this site. Clearing local storage will sign you out and reset your preferences. Blocking it entirely will stop you from signing in, because the session token then has nowhere to live.
Questions
If anything here does not match what you see in your own browser, we want to know. Email datarooms@99developer.com and we will correct it.