Cookies
Last updated: July 25, 2026 · version 2026-07-25
Categories
We split everything into three groups. Only the first is required, and it is required because without it the service you asked for does not exist.
Essential
always onThey keep you signed in (the Auth.js session cookie), protect forms against CSRF and store this very cookie choice (cp_consent). They measure nothing and they never leave this site.
Performance of the requested service under LGPD art. 7, V (no consent needed).
Analytics
Self-hosted Umami, no cookies and no fingerprinting: it records page, referrer, country and device type in aggregate. It tells us which prompts the community is looking for. Without your consent, the script never even loads.
Consent (LGPD art. 7, I).
Preferences
Stores the theme key in your browser’s local storage. If you refuse, the site keeps working and simply follows your system theme on every visit.
Consent (LGPD art. 7, I).
Full list
Everything we can write to your browser, with no exceptions. Where you see localStorage, it is not a cookie: it is browser local storage, which does not travel with every request.
| Name | Purpose | Duration | Category |
|---|---|---|---|
| authjs.session-tokenCookie | Keeps you signed in. Holds the session JWT issued by Auth.js; without it, every click would ask you to sign in again. In production the name gets the __Secure- prefix. | 30 days (or until you sign out) | Essential |
| authjs.csrf-tokenCookie | Protects the sign-in and sign-up forms against cross-site request forgery (CSRF). In production: __Host-authjs.csrf-token. | Browser session | Essential |
| authjs.callback-urlCookie | Remembers which page to send you back to after signing in. It is what makes the “Sign in” button on a protected page return you there. | Browser session | Essential |
| authjs.pkce.code_verifier / authjs.stateCookie | Security for signing in with Google or GitHub (OAuth PKCE and state). Created only when you start that flow and discarded as soon as it ends. | 15 minutes | Essential |
| cp_consentCookie | Stores your own cookie choice, with the version of the text and the date. It is the cookie that stops the banner from asking again, and our proof that you decided. | 6 months | Essential |
| cp_consent (mirror)localStorage | The same choice mirrored in local storage, so the site knows your decision before any request reaches the server. | Until you clear the site data | Essential |
| themelocalStorage | Remembers whether you prefer the light or the dark theme. If you refuse the Preferences category, the key is deleted and the site follows your system theme. | Until you clear the site data | Preferences |
| NEXT_LOCALECookie | Remembers your language choice (Portuguese or English) so the site opens in the same language next time. | 1 year | Preferences |
| umami.* (measurement script)Cookie | The Umami we host is cookieless: it writes no identification cookie and no fingerprint. It only loads with your Analytics consent; without it, the script never even enters the page. | Stores no identifier | Analytics |
Sessions and devices
The sign-in cookie in the table above says who you are. From the request that carries it we also keep a record of which device is using the account. That record is not a cookie: nothing extra is written to your browser.
- Each record holds browser, operating system, device type (desktop, mobile, tablet or bot), interface language, approximate region (country and state) and ip_hash, never the IP itself. Coming back from the same device updates the same row instead of creating a new one.
- Why: security, anti-fraud and moderation, so you can spot an access that was not yours and so we can act on abuse. It is neither analytics nor marketing: it never feeds audience measurement and no third party receives it.
- Legal basis: legitimate interest (art. 7, IX), to keep accounts safe. You may object at any time.
- How long: 90 days counted from the last time the device was seen. A scheduled routine deletes what is older, and deleting your account erases everything at once.
- Control: the list of your devices is in Settings. Ending a session there deletes its record.
Third parties
- No ad networks. There is no Meta pixel, no Google Ads and no other network, and we do not plan to have one.
- Self-hosted Umami. Audience measurement runs on a server of ours, not on a third-party service. The aggregate data never leaves it.
- Google and GitHub only come in if you choose to sign in with them: at that point the cookie is the provider’s, on the provider’s page, under the provider’s policy.
- When you watch a video or view an image published here, the file comes from our Cloudflare R2 bucket, which sets no tracking cookie.
How to manage
- Here on the site: opens the same panel as the banner, with the categories you can switch on and off. Switching one off takes effect immediately: the analytics script is removed from the page and the theme key is deleted.
- In your browser: you can block or delete cookies in its settings. Deleting the essential ones simply signs you out. Nothing else breaks.
- Without an account: browsing without signing up stores nothing beyond your cookie decision.
Details about which personal data we process and why are in the Privacy Policy.