Storage

One cookie, two keys, and a panel that checks.

A storage policy is easy to write and hard to keep honest, because the code moves and the page does not. This one is generated from the same declaration the app uses, and it ends with a panel that reads your browser and reports any disagreement.

Effective2026-08-02

01The short version

This site sets one cookie, and only when you are signed in: the session that keeps you signed in. It runs no analytics, no tag manager, no advertising pixel, and no third-party script of any kind. Everything else it keeps is in your browser’s local storage, and none of it identifies you to anyone else.

That is why there is no Accept and Reject pair anywhere on this site. Consent is for storage that is not strictly necessary. There is none here: a session cookie for a person who chose to sign in is necessary by definition, so a consent gate would be asking your permission for the one thing you already asked for.

02Cookies

One, and only while you are signed in. No third-party cookie, no tracking cookie, no advertising cookie, and nothing that follows you to another site.

sb-…necessary

Sign-in session

Holds the access and refresh token issued when you sign in, so a page reload does not sign you out. Written by the Supabase auth client, first-party, to this site only. The token proves who you are to the gateway and is scoped to your account. It is split across numbered cookies because a session is larger than one cookie holds.

Lifetime: Until you sign out, or until the refresh token expires.
If cleared: You are signed out and will need to sign in again.

It carries SameSite=Lax, so it is not sent when another site links to this one, and Secure, so it never crosses plain HTTP. It is first-party to this site and is read by this site only.

You do not have to take that on trust. The panel at the bottom of this page reads document.cookie in your browser and lists what it finds. Anything it finds that is not declared above is flagged as undeclared rather than explained away.

03What is stored locally

Every entry this build writes, with what breaks if you remove it.

verity-themepreference

Theme preference

Records whether you chose light, dark, or system, so the first paint after a reload is the theme you picked rather than a flash of the wrong one.

Lifetime: Until you clear it or switch back to system.
If cleared: The theme falls back to your operating system setting.

verity-storage-noticenecessary

Storage notice

Records that you have read the storage notice, so it is not shown on every page load.

Lifetime: Until you clear it.
If cleared: The notice appears once more.

The session cookie is named with a project identifier in it and is split across numbered parts, which is why it is listed as a prefix rather than an exact name.

04Why none of it asks for consent

The ePrivacy Directive requires consent before storing or reading information on a device, with an exemption for storage that is strictly necessary to provide a service the user explicitly requested. A session token for a service you signed in to, a theme you chose, and a record that you dismissed a notice all sit inside that exemption.

The reasoning is worth stating rather than assuming, because the alternative is worse than useless. A banner that demands consent for necessary storage teaches people to click through dialogs without reading them, which makes the one dialog that should matter worth nothing.

If a future build adds anything optional, it will be off by default, it will be declared here first, and refusing it will take exactly as many clicks as accepting it.

05Third parties

The marketing pages you are reading load nothing from another origin. Fonts are served from this deployment, the ambient background is generated in your browser rather than downloaded, and there are no embeds.

Inside the app, requests go to the deployment’s own gateway and to the authentication service. Model providers and any connectors you add receive data as part of doing the work you asked for, which is covered in Privacy §3. None of them set storage in your browser.

06Managing it

Use the panel below, or clear site data from your browser settings, which has the same effect. Clearing the session signs you out. Clearing the theme returns you to your operating system setting. Neither loses any work: everything you have made lives in your account, not in your browser.

Local storage is per browser and per device, so clearing here does not affect another machine you are signed in on.

07Inspect

These documents describe the software in this repository and the deployment you are reading them on. They are not legal advice. If you run your own instance, read them as a starting template and replace every operator slot before you put them in front of anyone. How the isolation is enforced.