Cookie Notice
DRAFT — pending attorney review. Prepared with engineering tooling, not by a lawyer.
Last updated: 2026-10-08
We use only the cookies and browser storage that are strictly necessary to run your sign-in and keep the site safe. We use no advertising, analytics, social-media or tracking cookies, no pixels, no session replay and no third-party fonts or widgets. Because nothing here needs your consent, there is no cookie banner. If we ever want something that does need consent, we will ask first, and "reject" will be as easy as "accept".
What is stored
| Name | Purpose | Lifetime | Set when |
|---|---|---|---|
__Secure-authjs.session-token (or authjs.session-token in development) | Keeps you signed in | Up to 7 days idle, 30 days maximum | After you sign in |
__Host-authjs.csrf-token | Protects sign-in forms against forged requests | Session | When a sign-in or sign-out form is used |
__Secure-authjs.callback-url | Remembers where to send you after sign-in | Session | When you start a sign-in |
theme (browser local storage, not a cookie) | Remembers your light/dark choice | Until you clear it | Only if you toggle the theme |
A first visit to the site, pricing pages or legal pages sets no cookies at all.
Third parties
- Stripe — when you start a checkout, the payment form is loaded from Stripe (js.stripe.com). Stripe may set its own cookies or use device signals for fraud prevention; this is part of the payment service you ask for. It is not loaded on a normal page view. See Stripe's privacy policy.
- GitHub and Google — if you choose "Continue with GitHub/Google", you go to their site, which has its own cookies.
Your choices
You can delete or block cookies in your browser, but signing in will not work without the session cookie. We do not track you across sites, so browser "Do Not Track" and Global Privacy Control signals change nothing about what we collect — and we honor GPC as an opt-out regardless.
More detail: Privacy Policy.