1. What we set — by category
The table below is the exhaustive inventory. If you find a cookie or storage key on a markst or Verus surface that is not in this table, please email dpo@markst.com and we will update this page.
Strictly Necessary — HTTP cookies
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
markst_preview | markst (via Cloudflare Pages Functions) | HMAC-signed preview-access cookie issued after NDA signature. Authorises access to gated marketing content (e.g. /sample-report). HttpOnly, Secure, SameSite=Lax. | 30 days | Strictly Necessary |
__cf_bm | Cloudflare | Bot-management: distinguishes humans from bots for rate-limiting and abuse protection. | 30 minutes (rolling) | Strictly Necessary |
_cfuvid | Cloudflare | Bot-management rate-limiting token; works with __cf_bm. | Session | Strictly Necessary |
cf_clearance | Cloudflare | Clearance token issued after a Cloudflare Turnstile challenge passes on /book-demo. Prevents bot submissions. | Up to 30 days (Turnstile default) | Strictly Necessary |
Strictly Necessary — browser localStorage (signed-in product)
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
markst_auth_user | markst | Authenticated user record. Keeps you signed in across tabs of the Verus application. Not shared with any third party. | Until logout or manual clear | Strictly Necessary |
markst_api_key | markst | API key issued by the SSO callback flow; authenticates backend requests from the Verus SPA. | Until logout or manual clear | Strictly Necessary |
juno_api_key | markst (legacy identifier) | Legacy API-key storage key used by valuation / review / LLM endpoints. Equivalent to markst_api_key; retained for backward compatibility during the rename. | Until manual clear | Strictly Necessary |
Preferences — browser localStorage
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
markst_cookie_notice_ack_v1 | markst | Timestamp of when you dismissed the cookie notice. Suppresses the notice on subsequent visits. | Persistent until manual clear | Preferences |
verus_theme | markst | Your light / dark theme choice inside the Verus application. | Persistent until manual clear | Preferences |
verus_density | markst | UI density choice (default / compact) inside the Verus application. | Persistent until manual clear | Preferences |
verus_active_fund | markst | Last-selected fund in the multi-fund dashboards. | Persistent until manual clear | Preferences |
juno_pricing_config | markst | Admin-only local pricing-config overrides (Verus admin surface). | Persistent until manual clear | Preferences |
verus_llm_messages, verus_llm_history, verus_llm_privacy_dismissed | markst | Saved LLM-assistant conversation state and privacy-notice dismissal inside the Verus application. | Persistent until manual clear | Preferences |
Preferences — browser sessionStorage
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
verus_upload_result | markst | Ephemeral upload-result blob passed between the Verus upload page and the subsequent results page. Never leaves your browser. | Session (cleared on tab close) | Preferences |
Analytics — cookieless
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| — (no cookies, no storage) | Cloudflare Web Analytics | Cookieless page-view beacon loaded on marketing routes (/, /about, /sample-report, /case-studies/*, /book-demo, /nda/*) only. Aggregated page metrics; no fingerprinting, no cross-site tracking, no individual identifiers. | N/A | Analytics (cookieless) |
2. What we explicitly do not use
- No Google Analytics, Google Tag Manager, or any Google-owned tracker.
- No Meta / Facebook, LinkedIn, or X / Twitter conversion pixels.
- No Mixpanel, Amplitude, Segment, Heap, Hotjar, or any other third-party product-analytics SDK.
- No advertising / retargeting cookies of any kind.
3. Consent and legal basis
The cookies and storage keys enumerated above are either (a) strictly necessary for the service to function, or (b) preference cookies that you set implicitly by interacting with the application (choosing a theme, dismissing a notice, etc.). The analytics beacon described above is cookieless and aggregate-only.
On this basis, a dismissible informational cookie notice (per UK ICO guidance under PECR / the ePrivacy Directive) is sufficient — you are informed that cookies are in use, and no non-essential cookies are set prior to interaction.
If we add any non-essential cookies or identifying analytics in future (e.g. Google Analytics, advertising pixels, or product-analytics SDKs that set identifying cookies), we will replace the informational notice with a granular accept / reject consent banner that blocks those trackers until you have actively accepted. The code comment at the top of src/components/legal/CookieBanner.tsx reflects this commitment.
4. Managing cookies and storage
You can clear cookies, localStorage, and sessionStorage from your browser settings at any time. Blocking strictly-necessary cookies or storage keys will prevent you signing in to the Verus application or accessing NDA-gated content. Blocking preference keys will reset your UI choices on the next visit.
5. Contact
Questions about this policy, or about specific cookies you observe in your browser, go to dpo@markst.com. We respond within five business days.