Cookie policy

We set the bare minimum.

Five cookies, all strictly necessary. No tracking, no third-party advertising, no consent banner because there's nothing to consent to. This page is the full inventory.

Version 1 · Last updated May 2026

Categories

The categories below are the standard GDPR/ePrivacy framework. We've enabled only what we genuinely need.

On

Strictly necessary

Cookies without which the site simply cannot function. Used for authentication, security, and your language preference.

Allowed under GDPR Recital 30 and ePrivacy Directive Art. 5(3) — no consent required.

Off

Functional

Would remember non-essential preferences like a saved layout or filter. We don't currently set any.

Not used today. If we add one, we'll switch this category on and update this page first.

Off

Analytics

Would help us understand how the site is used. We don't currently set any — we use server-side aggregate logs instead.

Server-side logs are anonymous and don't require consent. We may add a privacy-friendly analytics tool later (Plausible-style) and will ask first.

Full inventory

Every cookie we ever set

  • authjs.session-token
    Auth.js · Persistent · 30 days
    Keeps you signed in. Stores the encrypted session id, nothing else.
  • authjs.csrf-token
    Auth.js · Session · Browser session
    Prevents cross-site request forgery on sign-in and other auth flows.
  • authjs.callback-url
    Auth.js · Session · Browser session
    Remembers where to send you after sign-in if you started from a protected page.
  • NEXT_LOCALE
    CatinTech · Persistent · 1 year
    Remembers your language choice so we don't ask again on every page.
  • __stripe_mid / __stripe_sid
    Stripe · Persistent · 1 year / 30 min
    Set by Stripe only on the checkout page to detect fraud and double payments. Not used anywhere else.

Your controls