Cookies & storage

Sign-in and request protection

The API sets first-party access, refresh and csrf cookies. Access and refresh tokens keep the browser signed in; the csrf cookie helps protect requests that change information. These are HttpOnly, SameSite=Lax cookies, with Secure enabled in production. Access defaults to 15 minutes and refresh to 30 days, but release configuration can change those periods. The csrf cookie lasts up to 30 days. Refresh can replace tokens. Signing out clears these cookies in that browser; device management can revoke sessions.

Blocking these cookies can prevent account access or changes. Public policy pages do not require a sign-in session. Cookie protections do not replace HTTPS, account security or safe browsing.

Your language choice

Local storage key next-together:languageremembers a chosen site language until cleared or changed. Choosing Auto removes the saved preference and uses browser language detection. A signed-in account can also save its language preference. The site falls back when browser storage is unavailable. These policy drafts remain in English and are explicitly labelled that way.

Private support receipt in this tab

After you attempt a public support request, session storage key next-together:support-receipt remembers the retry key, private status code and reference when available. It supports recovering a lost reply and checking status in the same tab; it does not store the request text, signature or contact email. Anyone with the reference/key and code can read the status and reviewer response, so keep them private. Session storage usually ends with the tab; save the values yourself if you need them later. When storage is blocked, the interface warns you and continues in memory. This is separate from analytics attribution.

Usage and campaign attribution

Local storage key anonymousId identifies a browser visit history for first-party usage and campaign attribution. Events can include a timestamp, event name, source/platform, limited structural metadata and URL campaign tags such as utm_source and utm_campaign. Registration can link this identifier and attribution to your account. An anonymous identifier does not make linked data anonymous.

This is distinct from essential sign-in storage. The candidate currently has no dedicated analytics consent or opt-out control. Clearing browser storage removes the local identifier, but does not erase server records or prevent the next tracked interaction from creating a new identifier. Storage denial uses an identifier held only for the visit. Do not treat a browser setting or this notice as consent to optional tracking.

OWNER REVIEW: decide which events are necessary, lawful permission/choice requirements in admitted countries, retention and a functioning withdrawal mechanism before invitations. A cookie banner claiming all storage is essential would not accurately describe this candidate.

Third parties and browser controls

No third-party advertising pixel is integrated in the reviewed application source. Actual deployment scripts, proxy logs, providers and any future marketing tags need a separate inventory. There is no verified Do Not Track or Global Privacy Control handling in this candidate. No sale/sharing exemption or compliance claim is made.

Your browser can clear or restrict cookies and local storage. Clearing everything can sign you out and reset language choices. See Privacy for server data andHelp for current request-channel limits.