Cookies and local storage

Last updated 27 August 2026

ePrivacy / PECR: we do not set optional or advertising cookies, so there is no cookie banner. The items below are strictly necessary to run the account, or they stay in this browser until you clear it.

• Auth session — the Supabase library keeps the signed-in session in this browser (usually localStorage, not a tracking cookie) so you stay logged in.
• Public config cache — sessionStorage copy of /api/public-config (Supabase URL and anon key, which are public).
• Last minted key — sessionStorage, so the connect snippet can fill in. It is gone when the tab session ends.
• Stripe — Checkout and the Customer Portal run on Stripe’s domain and follow Stripe’s cookie policy there.

Azure or the browser may set a load-balancer affinity cookie (ARRAffinity) so you hit the same instance. That is a strictly necessary first-party cookie.

See the Privacy Policy for what we store on the server.