Cookies and storage
Draft of 4 November 2026
This website sets no cookies. It runs no analytics, advertising or social media scripts, and every file it loads comes from this website.
What we keep in your browser
| What | Where | Why | How long |
|---|---|---|---|
| Your tab's sign-in value | sessionStorage, set when you pick Apple, Google or Facebook on the sign-up page or the welcome page | Strictly necessary: a random value that ties a sign-in to the browser tab that started it, so a sign-in someone else started can't finish in your browser. It reaches our server in the address of the request that starts the sign-in, and again when the welcome page finishes it. Our server stores only a scrambled (hashed) copy of it: with the sign-in record while you are at the provider (usable for 10 minutes), then with the welcome page's hand-off (usable for 5 minutes); one left unused is deleted by a daily clean-up, and none is kept once the hand-off is used. The address of that start request, with the value in it, may also be in our server's logs for as long as they are kept; the value is no use to anyone once the sign-in is over. | Until the sign-in finishes, whether it worked or not, or until you close the tab. Starting another sign-in replaces it. |
| Your welcome-page session token | sessionStorage, only on the welcome page | Strictly necessary: it lets the welcome page show your sign-up, your code and your free months after you sign in. | Until you sign out, delete your sign-up or close the tab. The token itself stops working after 30 days, and signing out ends it on our side too. |
That is all. Nothing is kept in your browser if you only read the website.
Signing in needs sessionStorage. If your browser blocks it (some private windows and privacy settings do), you can still read the website but you can't sign in: the sign-up page says so before you pick a provider, and nothing is kept anywhere else instead.
Referral links
A GM's referral link (/r/ and their code) takes you to the sign-up page with the code in its address. The
code travels only in that link: we don't put it in a cookie or in your browser's storage, and it is gone if you close
the page before signing up.
Signing in with Apple, Google or Facebook
When you choose a provider, you go to its own website to sign in. Its cookies there are its own, under its own cookie and privacy policies.
Why there is no cookie banner
We keep nothing in your browser that isn't strictly necessary for something you asked for, so there is nothing to agree to. [to be confirmed: counsel's confirmation that no consent is needed for the sign-in value or the session token]
Our host, Cloudflare, can set cookies of its own to protect a website from attacks. [to be confirmed: that none are set with the domain's current Cloudflare settings]