Cookies & browser storage
Version / effective date: 2026-10-19
Read the full English policy
Current storage
Signing in sets one necessary HttpOnly, SameSite=Strict session cookie limited to the API /auth path, so a reload keeps you signed in; it lasts for the configured session lifetime (at most 30 days) or until you sign out. Page scripts cannot read it, and the short-lived access token stays in JavaScript memory only. Google OAuth, when enabled and initiated by you, uses HttpOnly state and PKCE-verifier cookies for up to 10 minutes at the callback path, then removes them. localStorage keeps only your interface preferences: language (platform.locale), theme (platform.theme) and whether you dismissed the language suggestion (platform.locale-hint). Production requires HTTPS.
Advertising cookies
Pages with ads load Google AdSense, which can set or read cookies and similar identifiers on Google’s ad domains to serve and measure ads, prevent fraud and, where permitted, personalize ads. Google Analytics sets first-party cookies to count visits and see which pages are read; Cloudflare Web Analytics measures page performance without cookies. No other advertising pixels are included. Where the law requires prior consent, the consent message lets you refuse non-essential cookies as easily as you accept them and change your choice later; refusing does not block the site. How Google uses cookies in advertising: https://policies.google.com/technologies/ads.
Your control
Use browser controls to clear site data or block cookies. Blocking authentication cookies can prevent Google sign-in. Signing out ends the session on the server immediately, including its access token, and clears the cookie. Necessary security controls are not disabled by an advertising preference.