Cookie policy

This website sets the cookies and local storage it needs to work; under § 25(2) no. 2 TDDDG they require no consent. We measure the audience with Cloudflare Web Analytics, but only if you agree (see “Audience measurement”). No advertising service is embedded, there is no cross-site tracking, and no profiles are built.

A single page behind the sign-in — “Account → Cards” — loads Stripe.js, because card details may only be shown inside a frame served by Stripe itself. Stripe may set its own cookies there; that is technically necessary in order to display the card. This happens on no publicly reachable page.

Two cookies are set on the freely accessible pages: the language, once one has been chosen or detected, and your decision in the cookie notice.

• NEXT_LOCALE — stores the language you chose. It lasts for the browser session only and is removed when you close the browser.
• c15t — your decision on audience measurement, along with a random identifier under which we keep the decision on our servers as proof (see the privacy policy). Lifetime six months.

With your consent the website loads a script from Cloudflare Web Analytics (Cloudflare, Inc., USA). It sets no cookies, but it reads details from your browser, such as load and rendering times, and sends them to Cloudflare along with your IP address. Because that accesses your device, we ask first (§ 25(1) TDDDG). Details are in the privacy policy under “Audience measurement with Cloudflare Web Analytics”.

Through “Cookie settings” at the bottom of every page you can change your decision at any time, and withdraw consent as easily as you gave it (Art. 7(3) GDPR). We ask for consent again after six months, and whenever the services we use change materially. We do not ask again after you reject. If you are signed in, your latest decision applies on all your devices.

These cookies are only set once you sign in or use the signed-in area. Signing in is technically impossible without them.

• better-auth.session_token — keeps you signed in. Valid for seven days, extended while you are active, and deleted when you sign out.
• better-auth.dont_remember — remembers that the session should not persist. Browser session only.
• better-auth.last_used_login_method — remembers the sign-in method you used last so it is preselected next time. 30 days.
• better-auth.state, better-auth.oauth_state and better-auth.pkce_code_verifier — secure the round trip to the identity provider against forgery. They exist only for the duration of that step.
• better-auth.two_factor — remembers a device confirmed as trusted for the second factor.
• app_session and app_secure_session — session cookies of our interface. Browser session only.
• sidebar_state — remembers whether the sidebar is pinned open. Seven days.

Your browser's local storage holds your appearance preference (light, dark or system), a marker that the introductory tour has already been shown, and your decision on audience measurement (c15t, like the cookie of the same name, with its identifier).

The first two are never transmitted to a server and never leave your device.

We use third-party services to repel automated requests and to process payments. Both are addressed exclusively from our server; no script is loaded and no cookie is set in your browser as a result. Details are in the privacy policy.

Every browser lets you inspect cookies, delete them individually or block them entirely. For the public pages this has no consequence beyond having to choose the language again on each visit.

If the sign-in session cookie is blocked, signing in is no longer possible — there is no other way to recognise an existing session between two page loads.