Legal
Cookies and local storage
Last updated: 14 October 2026
This policy covers everything 99 Data Rooms stores on your device, not just cookies. The law that applies here (Regulation 6 of the Privacy and Electronic Communications Regulations) treats browser local storage the same way it treats cookies, because what matters is that something is stored on your equipment, not which technology does the storing.
Cookies: none from us, unless you agree to session replay
99 Data Rooms itself sets no cookies: signing you in uses your browser's local storage instead. The one exception is optional. If you agree to the session-replay analytics on our public marketing pages, Microsoft Clarity sets two cookies on this site and five on Microsoft's own domains, all listed below. None of them is set without that agreement, and none of it runs inside an account or on a document someone shared with you.
What we store on your device
Everything below is first-party: stored by 99 Data Rooms, for 99 Data Rooms, and never used for advertising, profiling, or tracking you across other websites. Most of it is either the session itself or a preference you set. Two entries are neither, and we have said so on the rows themselves rather than rounding them up into the same sentence: they are copies of your own information that the app keeps on your device so a screen can appear before the server answers. The lists below are the complete set. A test reads every place the code writes to your browser and fails the build if something is written that is not named here, or named here that is no longer written.
If someone shared a document with you
These are the only things written to your device when you open a link someone sent you. No analytics or tracking script runs on that page at all.
| What | Where | Why | How long |
|---|---|---|---|
99dr.visit.* | Session storage | Lets you reload the page without losing your place or being counted as a second visitor. It holds the token that keeps that tab authorised after you pass the link's gates, so for as long as the tab is open it is a key in the same sense as the entry below, and it is what authorises a download. | Until the tab closes |
99dr.remember.* | Local storage | Proves you already confirmed your email address on that link, so coming back does not ask you to do it again. See the note below. | We stop accepting it 30 days after it is issued. Clearing your browser storage removes it sooner |
99dr.v.theme | Local storage | Remembers whether you chose the light or dark view for reading documents. | Until you clear it |
dr-sign-grant | Session storage | Only on a signing page that asks you to confirm your email address with a code: proof that this browser entered the code, so that you can sign and nobody else holding the signing link can sign as you. It is useless without that link, and it stops working 30 minutes after you enter the code. | Until the tab closes |
The middle entry deserves a sentence of its own, because it is the only thing on this page that acts as a key rather than a preference. It stands in for the email confirmation you already completed, so anyone who can read your browser profile could use it to reopen that particular link as you. It is issued only for links that ask for an email address, it is specific to the one link it was issued for, and it never lets anyone past a passcode or a document that still needs signing. We stop accepting it 30 days after it is issued, and clearing your browser storage removes it before then. On a shared or public computer, clear it.
If you have an account
| What | Where | Why | How long |
|---|---|---|---|
sb-*-auth-token | Local or session storage | Keeps you signed in. This is the session itself, so without it you cannot use the app. | Until you sign out, or until the tab closes if you did not choose to stay signed in |
dr-keep-signed-in | Local storage | Remembers whether you chose to stay signed in, so we know which of the two stores above to use. | Until you clear it |
dr-workspace:* | Local storage | Remembers whether you were last working in your personal space or in an organisation. | Until you clear it |
dr-room-prefs:* | Local storage | Remembers your room tab order and preferences inside the app. | Until you clear it |
dr.railWidth | Local storage | Remembers how wide you set the folder pane in a data room. | Until you clear it |
dr-spaces-snap:* | Local storage | A copy of your own room list, including the room names, so the app can draw it immediately instead of showing you an empty screen while it asks the server. This is a cache rather than something you chose, and the app works without it. | Until you clear it |
dr:sort:* | Local storage | Remembers the sort order you chose for a list of rooms or documents. | Until you clear it |
dr:view:* | Local storage | Remembers how you chose to view a list: row spacing, and whether file details are shown. | Until you clear it |
dr-qa-views:* | Local storage | Remembers filters you saved in the questions and answers list. | Until you clear it |
dr-cmd-recents:* | Local storage | The last six commands you ran, so the command palette can offer them first. This is a record of what you did rather than something you chose, and the app works without it. | Until you clear it |
dr.legal.panel.* | Local storage | Remembers which panels you had open in the document drafting workspace. | Until you clear it |
99dr:tour:v1 | Local storage | A marker that you have already seen the introductory walkthrough, so it does not reappear. | Until you clear it |
99dr:botpanel:v1 | Local storage | A marker that you have already seen the assistant panel introduction. | Until you clear it |
99dr:org-discovery:v1:* | Local storage | A marker that you dismissed the suggestion to join an organisation that shares your email domain, so we stop asking. | Until you clear it |
dr.folders.expanded.* | Local storage | Remembers which folders you left open in a data room. | Until you clear it |
dr.comment-draft.* | Session storage | Holds a comment you have started typing but not posted, so a reload does not lose it. | Until the tab closes, or until you post the comment |
99dr:tabpath:* | Session storage | Remembers where you were in each tab of the app, so switching back returns you to the same place. | Until the tab closes |
dr:contract-link | Session storage | Carries your choice of document between the two steps of linking a contract. | Until the tab closes, or until the step finishes |
Everywhere
| What | Where | Why | How long |
|---|---|---|---|
app-theme | Local storage | Remembers whether you chose the light or dark theme. | Until you clear it |
dr-analytics-consent | Local storage | Your answer to the optional session-replay analytics described below, and the date you gave it. We keep the date because if we ever ask you to agree to something different, we have to be able to show what you actually agreed to and when. It holds no identifier. If it is missing, the answer is treated as no. | Until you clear it, or until you change your answer from the footer |
dr-first-touch | Session storage | How you arrived, in one of five words: from an AI assistant, from a search engine, from an advert, from another website, or directly. It also keeps the page you landed on. We use it to see which of those brings people who go on to sign up. It holds no identifier, not the site you came from, and nothing from the web address you followed. It is written once, on the first of our public marketing pages you open. It is not written at all if you arrive straight at a shared document, at sign-in, or inside your account. It is written only if you choose Allow on the banner on our public pages, and never if your browser sends Global Privacy Control or Do Not Track; choosing No thanks, or changing your answer later, deletes it. | Until the tab closes |
skipgc | Local storage | The opt-out for our page-view counter, described below. We check for it on every public page; it is only written if you ask for it, by visiting 99datarooms.com/#toggle-goatcounter. While it is set, this browser is not counted at all. | Until you clear it, or until you use the same link to turn counting back on |
Support and our own staff
Three more entries exist for completeness. Nothing writes them during ordinary use of the site, and we list them because this page is meant to be the whole answer rather than the convenient part of it.
| What | Where | Why | How long |
|---|---|---|---|
dr-api-host | Local storage | Written only if our support team asks you to open a link with a diagnostic setting on it. It records which of two routes your browser should use to reach us while we look into a problem. | Until you clear it, or until you open the link that turns it off |
dr-preview-host-ok | Local storage | Written only on our own test builds, so our team can check a page there instead of being sent to the live site. It cannot be set on 99datarooms.com. | Until cleared |
admin.view.prefs.v1 | Local storage | Our own internal console. Remembers which cards a member of our team had folded away. Never written on a page you can reach. | Until cleared |
Analytics, without cookies
On our public marketing pages we use GoatCounter and Cloudflare Web Analytics, two privacy-first analytics tools that count aggregate page views, page-load performance and simple interaction counts without setting any cookies. Neither builds a profile of you, neither builds a cross-site profile, neither uses advertising identifiers, neither shares anything with ad networks, and neither stores an identifier on your device. We never run analytics or trackers on document viewers, only on these public pages.
One thing is kept on your device, and it is the opposite of tracking: a record of whether you have told the counter to stop. Visiting 99datarooms.com/#toggle-goatcounter sets skipgc in this browser, and while it is set nothing here is counted at all. Visiting the same link again turns counting back on. That record is the only thing either tool reads or writes on your device, it carries no identifier, and it exists purely to carry out a choice you made. So neither of these two counters needs your permission, and neither is what the banner below asks about.
The interaction counts are just that: how many people pressed a particular button, and how far down a page people read. Each one is a total against a fixed list of names we chose in advance. They carry no identifier, nothing you typed, and nothing about the content of the page you were reading.
Being plain about what they do receive: like any web request, each counting request carries your IP address, which is used to answer it and to filter automated traffic. Neither tool is sent the page's query string. Your address is never combined with a profile of you. Our own servers also read it for one further purpose, described next.
What our servers note about a request
On our public pages only, our servers note which network a request arrived from. Every address on the internet belongs to a network, and that network has a registered owner: usually a broadband or mobile provider, sometimes a cloud host, occasionally an organisation large enough to run its own. We record the owner's name and country, the page requested, the referring site's domain, whether the request came from a known AI crawler, and, if you arrived by clicking a link in an AI assistant's answer, which assistant it was. This tells us that someone on a university network read a page. It does not identify you, and it is not designed to: on a large network it says almost nothing about any one person.
We do not store your IP address, and we derive no identifier from it: no cookie, no fingerprint, no key that could link two of your visits together. We do read the page's query string to work out whether an assistant sent you, but we never store it.
A network that generated very little traffic in the period is never named in our reports, because the less traffic there is behind a name, the closer that name comes to being about a person rather than an organisation. Being straightforward about the limit of that: it is a threshold on traffic, not on the size of the organisation. A small firm whose staff read several pages will clear it and can be named, in the same way a visit has always been visible in an ordinary server log.
Records are kept for 90 days. The organisation-level counts worked out from them are kept for 36 months, and a small network's name and number are discarded from those counts after 12 months.
Nothing here is stored on your device, so there is nothing to consent to. We rely on our legitimate interest in understanding who our public writing reaches. You can object at any time, and you do not have to write to us to do it: if your browser sends a Global Privacy Control or Do Not Track signal we record nothing about the request at all. That signal is how an objection to this record works, because the record keeps no identifier for you; our Privacy Policy explains how to object to anything else.
We never run analytics or trackers on document viewers. If you are reading a document someone shared with you, no analytics script runs on that page at all. The person who shared it does see page-by-page visit analytics for their own link, which is a core feature of the product described in our Privacy Policy, not something a cookie does.
Session replay, and only if you say yes
On these public marketing pages, and nowhere else, we ask whether we may use Microsoft Clarity. It records how the pages themselves are used, so we can see where people get stuck or confused, and it draws heatmaps of where people click and how far they read. It is off unless you agree, it never runs on a document somebody shared with you, it never runs inside your account, and it never runs for anyone who is signed in.
You can change your mind whenever you like, from the analytics link in the footer of every page. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as a no and we do not even ask. Clarity itself honours GPC but, by Microsoft's own documentation, does not respond to Do Not Track, so we act on that signal ourselves rather than leaving it to them.
We never tell Clarity who you are. We do not send it your name, your email or any account identifier, and the recording is masked so that text you type and the contents of documents are not captured.
The cookies Microsoft sets, including the ones we cannot delete
If you agree, Microsoft sets the following. Two are ours in the sense that they are set on this site; five are set on Microsoft's own domains, and two of those are identifiers Microsoft uses across other sites as well. We are telling you this plainly because clearing your browser data for 99datarooms.com will not remove them.
| What | Whose domain | Why | How long |
|---|---|---|---|
_clck | This site | Keeps one Clarity identifier for this browser on this site. | 1 year |
_clsk | This site | Joins the pages you look at in one sitting into a single recording. | 1 day |
CLID | Microsoft | Identifies the first time Clarity saw this browser on any site that uses Clarity, not only ours. | 1 year |
MUID | Microsoft | A Microsoft browser identifier. Microsoft describes it as used for advertising, site analytics and other operational purposes. | 1 year |
SM | Microsoft | Synchronises that identifier across Microsoft domains. | Session |
ANONCHK | Microsoft | Records whether identifiers are being used for analytics measurement. | 10 minutes |
MR | Microsoft | Indicates whether to refresh the identifier above. | 7 days |
Declining, or withdrawing later, stops the script loading and removes the two set on this site. The five on Microsoft's domains are not ours to delete. To clear those you need your browser's own controls, or Microsoft's opt-out, which its FAQ points to at optout.aboutads.info.
How long Microsoft keeps it, and what we can and cannot delete
Recordings are kept for 30 days. Heatmaps, and a randomly chosen sample of recordings, are kept for up to 9 months.
Being straight about a real limitation: Clarity has no way to delete one person's data. Microsoft's guidance is that the whole project must be deleted to remove a single user's data. That is why we never identify anyone to it and why masking is on: there is no name, email or account id in what it holds, so there is nothing in it that can be looked up as yours. If you ask us to erase your data and you want us to act on Clarity specifically, we will delete the project. Ask us at alerts@99developer.com.
For this, Microsoft is not working under our instructions in the way our other suppliers are: it decides how it uses this data for its own purposes as well, so it is an independent controller alongside us rather than a processor. Our contract is with Microsoft Ireland Operations Limited. See our sub-processor register for how that differs from the rest of our suppliers.
Third-party services that may set their own cookies
Two parts of the service are provided by other companies, and they may set their own strictly necessary cookies on their own domains when you use those specific features.
- Cloudflare Turnstile protects our sign-in and sign-up forms from automated abuse. It may set a short-lived cookie to remember that a challenge has already been passed. This is a security control, and the service cannot safely be offered without it.
- Paddle handles payments and is the merchant of record. On our pricing and checkout pages Paddle loads its own script and may set cookies necessary to process a transaction and prevent payment fraud. Paddle decides how it uses that data as an independent controller. See our sub-processor register.
No advertising pixels or fingerprinting
We do not use advertising pixels or device fingerprinting anywhere. The only session recording, and the only cookies that are also used across other websites, are Microsoft Clarity's, which run on our public marketing pages only if you agree, as described above. Nothing of the kind runs inside the product or on a document someone shared with you. That is a deliberate part of building a tool you can trust with confidential documents.
Managing what is stored
You can clear site data, cookies and local storage in your browser settings at any time, and you can block them for this site. Clearing local storage will sign you out and reset your preferences. Blocking it entirely will stop you from signing in, because the session token then has nowhere to live.
If you have opened a document someone shared with you, clearing local storage also removes the entry that remembers you confirmed your email address on that link, so the link will ask you to confirm it again next time. That is the right thing to do on a shared or public computer.
Questions
If anything here does not match what you see in your own browser, we want to know. Email alerts@99developer.com and we will correct it.