Cookies

We use a small number of strictly necessary cookies and no advertising, analytics or tracking cookies. There is no consent banner because there is nothing optional to consent to.

• Session cookie — keeps you signed in. Set when you sign in, expires after 30 days of inactivity, and is removed when you sign out.
• Two-factor cookie — only if you turn on two-factor authentication. Records that this browser has passed the second factor, for 12 hours.
• Sign-in state — short-lived cookies used during the sign-in exchange to prevent cross-site request forgery.

All of these are HTTP-only where possible, and marked Secure and SameSite in production.

The app is installable as a Progressive Web App. Its service worker caches the icons and app manifest so it opens quickly offline. Private pages and API responses are never cached.

Blocking these cookies will stop you being able to sign in — they are what identifies your session. There is no way to use the product without them.