Cookies and Browser Storage

Necessary authentication storage

Supabase authentication cookies maintain sign-in and refresh sessions. Server-set cookies use HTTP-only and SameSite protections, with Secure enabled on HTTPS. Recovery flows also use temporary password_recovery_pending and password_recovery_user cookies to authorize password changes; these are configured for up to one hour.

The workspace cookie remembers a selected workspace. The server still checks access; this cookie is not an authorization grant. Supabase session lifetimes depend on provider settings rather than a fixed lifetime promised here.

Appearance preferences

Local storage keys pm_theme_mode and pm_accent_color remember theme and accent choices on your device. New preferences default to light. Clearing browser storage resets saved choices and may sign you out.

Security checks and external sign-in

Account forms load Cloudflare Turnstile to help prevent abuse. Cloudflare may process browser and request signals under its policies. Google sign-in takes you through Google and Supabase; their sites may use their own cookies. Vercel and other providers may handle necessary infrastructure/security metadata.

Tracking and controls

Our code audit found no advertising or optional analytics integration, so we have not added an optional-tracking consent banner. Necessary authentication and user-selected preferences remain in use. We will review controls before introducing optional tracking.

You can block or remove cookies through your browser and clear site storage. Blocking necessary cookies can prevent login, recovery, and workspace selection from working. Browser settings do not delete your server-side account. Request account deletion through Settings or contact support.