Effective Date: 11 August 2026 · Version: 1.0
Part of the Privacy Policy.
1. The short version
We use strictly necessary cookies only. No advertising cookies, no analytics cookies, no tracking pixels, no session recording, no social plugins, no fingerprinting.
That is why you do not see a cookie consent banner: under the ePrivacy Directive, consent is not required for cookies strictly necessary to deliver a service you requested.
2. What we set
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| Session token | Keeps you signed in. Without it you cannot use the Service. | Strictly necessary | Session / until expiry |
| Auth callback state | Protects the sign-in flow against cross-site request forgery | Strictly necessary | Minutes |
| Payment checkout cookies | Set by our payment processor during checkout to process your payment securely and prevent fraud | Strictly necessary (third party) | Per that processor's policy |
The session cookie is httpOnly (JavaScript cannot read it), Secure (HTTPS only), and SameSite=Lax.
3. Browser storage we use
Not cookies, but you should know about them:
| Storage | What | Why |
|---|---|---|
| IndexedDB | A working copy of your decks, scoped to your signed-in account | Keeps the editor fast. Your decks are also stored on our servers — see Privacy Policy §5. Clearing it does not delete your decks. |
| localStorage | UI preferences — theme, panel layout | Remember how you like the editor |
Clearing your browser data deletes your decks permanently and we cannot recover them. Export anything you cannot afford to lose.
4. What we do not do
- No Google Analytics, Meta Pixel, or equivalent
- No advertising or remarketing cookies
- No cross-site tracking or data brokerage
- No session recording or heatmaps
- No device fingerprinting
- No social media plugins or embedded trackers
5. Managing cookies
You can block or delete cookies in your browser settings — but blocking the session cookie will stop you signing in.
Your browser's Global Privacy Control signal is honoured. Since we do not sell or share personal information or run non-essential tracking, a GPC signal has nothing to switch off — but it is recorded and respected.
6. If this changes
If we ever introduce a non-essential cookie — analytics, for example — we will:
- Ask for your consent first, through a banner with a genuine reject option
- Set nothing non-essential until you agree
- Let you withdraw consent as easily as you gave it
- Honour Global Privacy Control automatically
- Update this notice and tell you before it takes effect
that is as easy to use as accept