Privacy policy
Last updated 22 October 2026. Shortbread runs cookie banners for websites. This page covers what Shortbread itself collects. The controller for data about Shortbread account holders and visitors to tryshortbread.com is Shortbread, United States, reachable at hello@tryshortbread.com. For visitors to sites that run the banner, the site owner is the controller and Shortbread is their processor under the data processing agreement.
On sites that use Shortbread
When a visitor makes a choice in a Shortbread banner, the banner stores that choice in a first-party cookie named shortbread_consent on that site, and sends one record to Shortbread containing the site key, the categories chosen, the method (clicked, implied by region, carried over, or Global Privacy Control), the country code, and a one-way hash of a truncated IP address and user agent. Shortbread does not store full IP addresses or set any cookie of its own on the visitor's browser. Records are kept for the site owner's plan retention period (30 days on Free, 5 years on Pro and Agency) so the owner can demonstrate consent.
Shortbread account holders
We store your email address, the domains you add, scan results for those domains, and billing status from Stripe. We email you sign-in links, weekly scan reports, and billing notices. Stripe processes payments; we never see card numbers.
Cookies on tryshortbread.com
tryshortbread.com sets a session cookie when you sign in, and a shortbread_ref cookie for 30 days when you arrive through a referral link, so the referrer gets credit if you upgrade. Neither is used for advertising, and tryshortbread.com runs no third-party analytics cookies; traffic is measured with cookieless Vercel Web Analytics.
The bill calculator
Checking a domain stores the domain, the detected consent tool, the page count, and the estimated incumbent cost. No personal data.