Legal Centre
Cookies
This website sets only Google Analytics’ cookies, which count visits. The platform and its sign-in pages set only the others below: to sign you in, keep you signed in safely, and remember a choice you made.
| Cookie | Set by | What it does | How long it lasts | Type |
|---|---|---|---|---|
auth_token | The platform, on backed.giving and its subdomains | Keeps you signed in. It holds a random session number and nothing about you. HttpOnly, Secure and SameSite=Lax, so no script can read it and no other site can use it. | Until you sign out, and never more than 1 day (8 hours when you signed in with single sign-on) | strictly necessary, first-party |
backed_saml_binding | The platform, only while you sign in with your organisation’s single sign-on | Ties the answer from your organisation’s sign-in service to the browser that asked for it, so nobody else can use that answer. | 10 minutes | strictly necessary, first-party |
backed_oidc_binding | The platform, only while you sign in with your organisation’s single sign-on | Ties the sign-in your organisation’s identity provider sends back to the browser that started it, so nobody else can use it. It holds a random number and nothing about you. | 10 minutes | strictly necessary, first-party |
backed_prefs | The platform, on backed.giving and its subdomains | Remembers your appearance, language and date format choices so the first page you see already uses them. It never says who you are. | Until you sign out, and never more than 1 day (8 hours when you signed in with single sign-on) | functional, first-party |
backed_brand | The sign-in pages | Remembers which funder’s branding to show on the sign-in pages when you come back. It holds the funder’s short name only. | 30 days | functional, first-party |
backed_cookie_check | The sign-in pages | Checks that your browser accepts cookies before you sign in, so we can tell you if it does not. It is deleted as soon as it has been read. | 10 seconds | strictly necessary, first-party |
| Cloudflare Turnstile | Cloudflare, on the sign-in pages only (signing in, signing up, joining and account recovery), when the security check runs | Tells people from automated sign-in and sign-up attempts. Backed uses it for that check and nothing else. | Set and ended by Cloudflare under its own privacy terms | security check, third-party |
| Google Analytics | Google, on this website (backed.giving) only: never on a sign-in page or in a portal | Counts visits and shows which pages are used, so we can understand our reach and improve the site. Its cookies (_ga, and _ga_ followed by an id) hold a random number, not who you are, and last up to two years. Nothing you type into the site reaches Google. | Set and ended by Google under its own privacy terms | analytics, third-party |
Pixels and web beacons: none on any Backed sign-in page or portal. On this website, Google Analytics sends Google a record of each page viewed, and nothing else.
Log files: the servers that deliver this website and the platform keep request logs (IP address, the page requested, browser type and time) for security and troubleshooting, for the hosting provider’s standard period, then delete them.
If you block cookies you can still read this website, but you can’t sign in to the platform. The sign-in page tells you when your browser is refusing them.
Backed doesn’t track you across sites. Google Analytics on this website doesn’t act on a Do Not Track or Global Privacy Control signal: to stop it, block its cookies in your browser or use Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). The sign-in pages and portals have nothing to turn off.
The Privacy Policy explains what else we collect and why.