Cookie Policy

A cookie is a small value a site stores in the browser and receives with later requests. localStorage and sessionStorage keep preferences on the device and are not normally sent to the server automatically.

We distinguish technologies required for sign-in and service security, local preferences and optional referral attribution.

NextAuth uses next-auth.session-token (or __Secure-next-auth.session-token, possibly chunked) for sessions, normally up to 30 days depending on renewal; next-auth.csrf-token (or __Host-next-auth.csrf-token) for authentication and next-auth.callback-url or its secure variant for return navigation. It also uses temporary OAuth state, PKCE or nonce according to provider and flow. These are not advertising cookies.

NEXT_LOCALE stores requested language, up to a year in onboarding. Turnstile and the Cloudflare proxy may use technical checks according to configuration. Theme is local storage, not a one-year cookie. Session and protection values are generated for requested functionality, without an advertising permission.

Only with separate attribution permission do we set ref_server or ts_ref when you arrive via ?ref= or ?aff=. The implemented maximum is 30 days; they attribute registrations or purchases and determine rewards or commissions. They do not track across sites. They are removed on claiming attribution or withdrawing permission. Withdrawal does not undo an already recorded attribution.

tsl_theme stores theme; tsl_privacy_choices_v2 separately remembers attribution and external content. Directory preferences, notification sound, dismissed notices/tutorials, local saves and interface state also exist. Local values remain until changed or removed; we promise no automatic one-year expiration. Session storage holds card entry and active call state within the tab, among other values.

The PWA may store application assets in Cache Storage through its service worker. We found no advertising profile in IndexedDB or Google Analytics/Meta Pixel SDK. Own visits, downloads and operational metrics do exist, with some deduplicated by IP hash; this is not a claim that activity is never measured. Future optional measurement requires review and controls before enabling it.

YouTube, Spotify and SoundCloud embeds can communicate IP, browser and page information and use their own storage. The youtube-nocookie domain does not itself eliminate all third-party communication. Embedded players stay blocked until external content is enabled, with an option to open the link outside this site. Withdrawal unmounts players; it cannot clear another domain’s cookies.

Remote images and requested audio can also communicate technical information; we do not claim every remote resource is blocked. OAuth, payments and captcha load for the corresponding requested functionality and follow provider conditions. This panel enables no own behavioral advertising.

Privacy Preferences, available from the Legal Center and settings, offers separate attribution and external content choices, off by default. “Necessary only” rejects both; “Save preferences” retains only what you select. Withdrawal is equally accessible and essential functionality remains available. Earlier blanket acceptance does not automatically grant these new purposes.

Local preference governs this browser. Signed-in decisions are also recorded for account audit without replacing local decisions on other devices. Blocked storage may prevent remembering choices; rejection remains available. No marketing toggle is offered because no general implemented marketing purpose was found.