Cookies
Last updated: July 25, 2026 · version 2026-07-25
Categories
We split everything into three groups. Only the first is required, and it is required because without it the service you asked for does not exist.
Essential
always onThey keep you signed in (the Auth.js session cookie), protect forms against CSRF and store this very cookie choice (cp_consent). They measure nothing and they never leave this site.
Performance of the requested service under LGPD art. 7, V (no consent needed).
Analytics
Self-hosted Umami, no cookies and no fingerprinting: it records page, referrer, country and device type in aggregate. It tells us which prompts the community is looking for. Without your consent, the script never even loads.
Consent (LGPD art. 7, I).
Preferences
Stores in your browser’s local storage the theme, the updates you’ve seen, the closed assistant, recent searches and the sensitive-content confirmation (full list on the Cookies page). If you refuse, the site keeps working: it follows your system theme on every visit, the updates icon lights up again until you open the changelog and the rest is asked again.
Consent (LGPD art. 7, I).
Full list
Everything we can write to your browser, with no exceptions. Where you see localStorage, it is not a cookie: it is browser local storage, which does not travel with every request.
| Name | Purpose | Duration | Category |
|---|---|---|---|
| __Secure-authjs.session-tokenCookie | Keeps you signed in. Holds the session JWT issued by Auth.js; without it, every click would ask you to sign in again. In production the name gets the __Secure- prefix. | 30 days (or until you sign out) | Essential |
| __Host-authjs.csrf-tokenCookie | Protects the sign-in and sign-up forms against cross-site request forgery (CSRF). In production: __Host-authjs.csrf-token. | Browser session | Essential |
| __Secure-authjs.callback-urlCookie | Remembers which page to send you back to after signing in. It is what makes the “Sign in” button on a protected page return you there. | Browser session | Essential |
| __Secure-authjs.pkce.code_verifier / __Secure-authjs.stateCookie | Security for signing in with Google or GitHub (OAuth PKCE and state). Created only when you start that flow and discarded as soon as it ends. | 15 minutes | Essential |
| cp_consentCookie | Stores your own cookie choice, with the version of the text and the date. It is the cookie that stops the banner from asking again, and our proof that you decided. | 6 months | Essential |
| cp_consent (mirror)localStorage | The same choice mirrored in local storage, so the site knows your decision before any request reaches the server. | Until you clear the site data | Essential |
| themelocalStorage | Remembers whether you prefer the light or the dark theme. If you refuse the Preferences category, the key is deleted and the site follows your system theme. | Until you clear the site data | Preferences |
| novidadesVistasAtelocalStorage | Stores the date of the latest site update you have already seen, so the updates icon at the top does not light up again for the same update. If you refuse the Preferences category, the key is deleted. | Until you clear the site data | Preferences |
| assistente-encolhidolocalStorage | Remembers that you closed the guide assistant’s bubble on Home and Explore, so it doesn’t reopen on its own. Only written with the Preferences consent; refusing the category deletes the key. | Until you clear site data | Preferences |
| cp:recent-searcheslocalStorage | Keeps the last six terms you typed in quick search (⌘K) so they show up as shortcuts. Never sent to the server. Only written with the Preferences consent; refusing the category deletes the key. | Until you clear site data | Preferences |
| copyprompt:mostrar-sensivellocalStorage | Remembers that you confirmed being 18 or older when revealing a cover marked as sensitive, so you’re not asked again for every image. Only written with the Preferences consent; refusing the category deletes the key. | Until you clear site data | Preferences |
| copyprompt:rascunho-publicarlocalStorage | Autosaved draft of the publish form (signed-in users only): what you typed comes back if the tab closes before you publish. Deleted when you publish or clear the draft. | Until you publish or clear site data | Essential |
| cp:publish-previewlocalStorage | The preview of what you’re publishing, stored only to open it in the preview tab (signed-in users only). Replaced on every preview. | Until the next preview or until you clear site data | Essential |
| NEXT_LOCALECookie | Remembers the language you picked in the switcher (Portuguese or English) so the site opens in it next time. Written by the language router on the switch, independent of the banner: it is what makes your choice stick. | 1 year | Essential |
| umami.* (measurement script)Cookie | The Umami we host is cookieless: it writes no identification cookie and no fingerprint. It only loads with your Analytics consent; without it, the script never even enters the page. | Stores no identifier | Analytics |
Sessions and devices
The sign-in cookie in the table above says who you are. From the request that carries it we also keep a record of which device is using the account. That record is not a cookie: nothing extra is written to your browser.
- Each record holds browser, operating system, device type (desktop, mobile, tablet or bot), interface language, approximate region (country and state) and ip_hash, never the IP itself. Coming back from the same device updates the same row instead of creating a new one.
- Why: security, anti-fraud and moderation, so you can spot an access that was not yours and so we can act on abuse. It is neither analytics nor marketing: it never feeds audience measurement and no third party receives it.
- Legal basis: legitimate interest (art. 7, IX), to keep accounts safe. You may object at any time.
- How long: 90 days counted from the last time the device was seen. A scheduled routine deletes what is older, and deleting your account erases everything at once.
- Control: the list of your devices is in Settings. Ending a session there deletes its record.
Third parties
- No ad networks. There is no Meta pixel, no Google Ads and no other network, and we do not plan to have one.
- Self-hosted Umami. Audience measurement runs on a server of ours, not on a third-party service. The aggregate data never leaves it.
- Google and GitHub only come in if you choose to sign in with them: at that point the cookie is the provider’s, on the provider’s page, under the provider’s policy.
- When you watch a video or view an image published here, the file comes from our Cloudflare R2 bucket, which sets no tracking cookie.
How to manage
- Here on the site: opens the same panel as the banner, with the categories you can switch on and off. Switching one off takes effect immediately: the analytics script is removed from the page and the Preferences keys are deleted.
- In your browser: you can block or delete cookies in its settings. Deleting the essential ones simply signs you out. Nothing else breaks.
- Without an account: browsing without signing up stores nothing beyond your cookie decision, the language you pick in the switcher and, only if you accept Preferences, the keys in that category.
Details about which personal data we process and why are in the Privacy Policy.