Cookie policy
There are three of them and one is optional. Here is the complete list.
Last updated: 30 July 2026
Draft — not yet in force
This document is missing its legal entity details (see config/legal.ts). Fill those in and have it reviewed before relying on it.
The short version
- We set a small number of cookies to keep you signed in. Without them the app cannot work, so there is no way to switch them off and still use it.
- We'd like to count page views. That one is optional, off until you accept, and you can change your mind any time.
- We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. There is no advertising network involved in this product at all.
The complete list
| Name | Category | What it does | How long |
|---|---|---|---|
authjs.session-token | Strictly necessary | Keeps you signed in. Without it you cannot use the app at all. | 30 days, or until you sign out |
authjs.csrf-token | Strictly necessary | Protects sign-in and form submissions against cross-site request forgery. | Session |
authjs.callback-url | Strictly necessary | Remembers where to send you after signing in. | Session |
cookie_consent | Strictly necessary | Stores this very choice, so we don't ask again. Held in your browser's local storage rather than a cookie. | 12 months |
Vercel Analytics | Analytics | Counts page views in aggregate so we know which pages are worth keeping. No cross-site tracking, no advertising profile. Only loaded if you accept. | No persistent identifier is stored |
Why the necessary ones don't ask permission
Cookies that are strictly necessary to provide a service the user has asked for are exempt from consent under the UK PECR and the EU ePrivacy Directive. Keeping you signed in and protecting the sign-in form against cross-site request forgery both fall squarely in that category — if you have asked to sign in, a cookie that remembers you are signed in is not something we should have to negotiate.
We rely on that exemption for exactly those cookies and nothing else. Analytics is not necessary, so it asks.
Analytics, specifically
If you accept, we load Vercel Analytics. It records aggregate page views — which pages get visited and roughly from where — and does not build a profile of you, follow you to other sites, or store an advertising identifier.
We use it for one thing: deciding which pages are worth keeping and writing more of. You'll notice this policy has no analytics vendors beyond that one; a habit app does not need a data warehouse.
Changing or withdrawing your choice
Use the button above, or the Cookie settings link in the footer of every page. Withdrawing consent stops collection immediately for the rest of your session — you don't need to reload.
If you're signed in, your choice is stored against your account as well as in your browser, so it follows you to a new device instead of resetting. You can also clear cookies and site data in your browser at any time, which resets everything and means the banner will ask again.
More detail
For what we do with the data behind those cookies — and everything else we hold — see the privacy policy.