Cookie policy

These are required for the platform to work and cannot be turned off because they are not optional features — there is no consent banner for them because the law does not require one for strictly necessary cookies.

• __Host-hs_session (production) / hs_session (development) — your signed-in session. HttpOnly, SameSite=Lax.
• __Host-hs_mfa (production) / hs_mfa (development) — a short-lived challenge during two-factor sign-in.
• hs_lang — the language you read the site in (English, Swedish, German, French, Spanish, Portuguese, Indonesian, Danish or Norwegian) across pages.
• hs_team — which team is selected in the dashboard.
• __Host-hs_social / __Host-hs_sso — a short-lived (10-minute) safeguard during sign-in with GitHub, Google or your company’s SSO.
• __Host-hs_invite — a sign-up invitation you opened, until the invitation expires (at most 30 days).
• __Host-hs_admin_session / __Host-hs_admin_mfa — platform staff only, in the staff console.

hs_first_touch in the browser’s sessionStorage: the address you came from, the first page and campaign words in the link. It holds no identifier, disappears when the tab closes and reaches us only if you sign up, when it is saved on the account.

• No third-party analytics or advertising cookie is set on the platform.
• No tracking pixel or marketing tag exists in the code.
• The platform adds no analytics or advertising cookies to customers’ sites; analytics for customer sites are counted without cookies.
• The sign-up, password reset and abuse report forms use Cloudflare Turnstile to stop bots (see /legal/subprocessors).

If a third-party cookie (for example analytics) is ever added, this page will be updated to reflect exactly what the code does, and consent will be requested wherever the law requires it.

Reach the operator at hello@hostingsurge.com.