Every cookie we set, what it is for, and how long it lasts. You can change your choice whenever you like.
Effective 23 September 2026 · Last updated 8 October 2026
This policy explains the cookies and similar technologies used on sms365.com.au and in the SMS365 console at app.sms365.com.au, operated by Peritus Digital Pty Ltd (ABN 58 675 347 716), trading as SMS365. It sits alongside our Privacy Policy, which explains how we handle personal information generally.
A cookie is a small file a website asks your browser to keep. Some are essential — without them you could not stay signed in. Others are optional, and are only used if you say so. We also use two related technologies: local storage, which keeps a setting on your own device and never leaves it, and a page-view counter that stores nothing on your device at all.
When you first visit sms365.com.au you are asked what we may use. Until you choose, analytics and advertising are switched off — not merely unrequested, but actively denied through Google Consent Mode before any tag loads. Nothing optional runs until you agree to it.
You can change your mind at any time: open cookie settings, or use the “Cookie settings” link in the footer of every page. If you withdraw consent for analytics, we also delete the analytics cookies already on your device for this site.
Your choice is itself remembered in a cookie (sms365_consent) for six months. That one is unavoidable — it is the only way to know not to ask you again — and it holds nothing but your answer and when you gave it.
These make the Service work and are not optional. They are set by us, on our own domains, and are never used to track you across other sites.
| Cookie | What it does | How long |
|---|---|---|
sms365_session | Keeps you signed in to the console. Marked HttpOnly and SameSite=Lax, so it cannot be read by scripts and does not travel on cross-site requests. | 14 days |
sms365_oauth | Ties a “Sign in with Microsoft” or single sign-on round-trip to the browser that started it, so someone else's sign-in cannot be completed in your session. | 10 minutes |
sms365_connect | The same protection when you connect an external system such as Xero or Shopify. | 10 minutes |
sms365_consent | Remembers the cookie choice you made here. | 6 months |
We use two things to understand which pages are read, and they are deliberately different:
Plausible counts page views without cookies, without local storage, and without collecting anything personal or building a profile of you. Because it stores nothing on your device and identifies no one, there is nothing to consent to, and it is not listed in the cookie settings. If you would rather not be counted at all, a browser-level content blocker will stop it.
If you turn analytics on, Google Tag Manager (container GTM-KNMGQCWT) loads Google Analytics, which sets cookies to tell repeat visits apart and to see which pages lead where. Typical cookies are _ga and _ga_<id>, lasting up to two years, and _gid, lasting a day. These are set by Google as a third party, and data may be processed overseas — see “Overseas disclosure” in our Privacy Policy. Turn this off and none of them are set.
We are not running advertising tags today. The setting exists so that if we ever do, your answer is already recorded and honoured from the first page load rather than asked for afterwards. Left off, no advertising cookie is set and no advertising identifier is shared.
Signed in at app.sms365.com.au, we keep a few preferences in your browser's local storage. These never leave your device, are not cookies, and are not used to track anything:
sms365_theme — whether you chose light or dark.sms365_getstarted_hidden — whether you dismissed the getting-started panel.sms365_compose_prefill, sms365_schedule_prefill — a message you were part-way through writing, held only until the next page opens it.The console itself carries no analytics or advertising tags. What you do inside your own account is your business.
Links in a text message — an unsubscribe link, or a link a business shortened through us — open pages we serve. Those pages carry no analytics, no advertising and no tag manager. We record that a tracked link was opened, because the business that sent it is paying to know whether anyone clicked, and that is described in our Privacy Policy. But we do not put a tracking tag in front of someone who is trying to unsubscribe, and we do not share those visits with anyone.
Every major browser lets you see, block and delete cookies — usually under Settings → Privacy. Blocking all cookies will stop you signing in to the console, because the session cookie is how we know it is still you. Blocking third-party cookies alone does not affect signing in.
If we add or remove a cookie, this page changes and the date at the top moves. A material change to what we use, or to why, will reset the choice we have recorded so you are asked again rather than carried along by an answer you gave to a different question.
Questions: [email protected], or write to Peritus Digital Pty Ltd, ABN 58 675 347 716.