Cookies

Nothing to switch off

Most cookie pages exist to let you decline analytics and advertising. This site has neither, so this page has no switches — declining is the only setting, and it is already how the site works.

Signed out, this site sets no cookies at all.

The two that exist

Both are set by our authentication provider, are first-party, and are marked HttpOnly and Secure — script on the page cannot read them:

• __Secure-neon-auth.session_token — keeps you signed in. Without it, every page load would ask you to sign in again. It goes when you sign out.
• __Secure-neon-auth.session_challenge — exists for the ten minutes of a sign-in round trip, so the reply from Google can be matched to the request that started it. It is what stops somebody else’s sign-in landing in your session.

Browser storage, which is not a cookie

Two things live in your browser’s local storage and are never sent anywhere: the theme you picked, and — when you are signed out — your recent conversions, so the history has something in it. Clearing site data in your browser removes both, and the app carries on without them.

If that changes

If anything optional is ever added, this page gets a real control before it is set, not after. The date above will say when.