Last updated: 28 July 2026 · Version 1.0
Template. The tables below list what this boilerplate actually sets, as shipped — if you add or remove vendors, open your browser's storage inspector on a fresh session and reconcile it against this page. A table that does not match reality is worse than none.
Known gap — decision deliberately deferred, PENDING: the analytics cookie below is set on first page load, WITHOUT consent — the template ships no consent banner, which the ePrivacy rules do not allow in the EU. The options are scoped in
docs/roadmap/2026-07-28-cookie-consent-gate.md; the smallest is running PostHog cookieless (persistence: "memory"— no cookie, no banner needed). Update this page when one lands, and revisit BEFORE an EU marketing push or adding any ad pixel.
What cookies are
Cookies are small files a site stores on your device. We also use closely related technologies — localStorage and sessionStorage — and treat them the same way here. Some are strictly necessary to make the Service work; the rest should run only with your consent.
The cookies we set
Strictly necessary
Always active. The Service cannot function without them, so they need no consent.
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token | Keeps you signed in — the session token, checked on every request | 7 days |
NEXT_LOCALE | Remembers your language when it differs from what your browser reports | Browser session |
We also keep a few preferences in localStorage, which never leave your browser:
| Key | Purpose |
|---|---|
theme | Light or dark mode |
Analytics
{{IF_APPLICABLE: This app ships no analytics tool, so it sets no analytics cookies. Add a table here naming each one the day you add a provider.}}
Marketing
We set no marketing or advertising cookies, and we do not share data with ad networks. {{CONFIRM: true as shipped — add a table here the day you add an attribution or advertising tool.}}
Payment cookies
{{IF_APPLICABLE: This app takes no payments and sets no payment cookies. If you add a hosted checkout, say here which provider sets cookies and link its privacy policy.}}
{{IF_APPLICABLE: When Cloudflare Turnstile bot protection is enabled, Cloudflare may set its own cookies on the sign-in and sign-up pages while verifying your browser. Delete this paragraph if Turnstile is off.}}
{{IF_APPLICABLE: When the Crisp support chat is enabled, Crisp sets its own cookies to keep your conversation. Delete this paragraph if Crisp is off.}}
Changing your choices
{{CONSENT_MECHANISM: The template ships no consent banner yet. Until yours exists, say so plainly — e.g. "We are building a cookie settings control; until then, manage cookies through your browser" — rather than describing a control that does not exist.}}
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will sign you out and break parts of the Service.
Changes
We will post any revision here with a new version number and effective date. How we handle the personal data behind these cookies is described in our Privacy Policy.
Questions: {{PRIVACY_CONTACT_EMAIL}}.