1. What we set
- Session cookies (Auth.js): keep you signed in across the dashboard. Without these, sign-in cannot work.
- Security cookies: CSRF protection and OAuth state during sign-in flows.
- Preference cookies: remember UI choices such as dashboard filters where applicable.
2. What we do NOT set
- No advertising cookies.
- No cross-site tracking pixels.
- No third-party analytics cookies on the marketing site.
Billing pages are hosted by Paddle, our merchant of record, which has its own cookie practices on its checkout pages.
3. Managing cookies
You can block or delete cookies in your browser settings. Note that blocking session cookies will sign you out and prevent dashboard access — that is how sign-in works, not a dark pattern.
4. Changes
If we ever add non-essential cookies, we will update this page and — where required — ask for consent first.