Cookies

What we set

• Authentication session cookie. Set when you sign in. Stores a signed JWT identifying your account. HTTP-only (not readable by JavaScript), Secure (HTTPS only), SameSite=Lax. Expires after 24 hours of inactivity. Without this cookie you cannot stay signed in — it is essential to the Service.
• CSRF cookie (set by Auth.js). Prevents cross-site request forgery on sign-in flows. Short-lived. Essential.

That's it. We do not set advertising, retargeting, social, or analytics cookies of any kind.

Third-party services

We use a few third-party services to run the Service. Each has its own cookie behavior:

• Vercel Analytics — counts page views by fingerprinting without using cookies. No cross-site tracking.
• Sentry — captures error stack traces. May create a short-lived session identifier in browser memory but does not set persistent cookies in the configuration we use.
• Vercel (host) — may set platform cookies for infrastructure functions like load balancing and bot detection. These are operated by Vercel, not by us.

None of these services receive your account password, points balances, or wallet contents.

Local storage

Some pages use the browser's localStorage or sessionStorageto remember small UI preferences (for example, whether you've dismissed the welcome tour). Local storage is not a cookie and is not sent to our servers.

Controlling cookies

You can block or delete cookies in your browser settings. If you block the authentication session cookie, you will not be able to sign in — every page protected by login will redirect you back to the sign-in screen. The Service is designed to operate entirely without third-party cookies, so blocking those should not affect functionality.

Changes

If we ever add a cookie not listed above, we'll update this page and material additions will be announced via the email on your account. See our Privacy Policy for the full data-handling picture.