Cookie policy
Tiny files. Big feelings. Mostly login.
Cookies are tiny files browsers store because someone decided the web needed stateful guilt. We use a modest set of them so sign-in, sessions, and “remember that I picked dark mode like a civilized person” actually work.
What you will probably see
Authentication/session cookies for NextAuth and related flows. Without these, you would re-login every click like it is 2003.
Preference cookies if we store UI choices locally (theme, etc.).
Operational/security cookies that help us detect abuse. Boring but important, like fiber.
What we are not doing
No analytics cookies, visitor IDs, third-party marketing pixels, or ad-tech shadow network built from your DOPE tables. Public pages may send first-party aggregate page-view and store CTA counts (optionally with UTM parameters on that request). Those counts are not tied to a person. The Privacy page has the full story.
Your controls
Browser settings let you block or delete cookies. Doing so may break login or staff tools. Totally your call, but do not file a bug titled “site forgot who I am” if you personally told the browser to forget everything.
EU friends: yes, banners are annoying. So is litigation. Pick your poison.