Cookie Policy

What We Set

A single session cookie, kraftify_session. It holds a random session id and nothing else. No name, no email, no preferences, no tracking id smuggled inside.

• HttpOnly: scripts cannot read it, so injected scripts cannot steal it.
• Secure and SameSite Lax: it travels over HTTPS and stays on this site.
• Thirty day expiry. Inactive sessions are deleted server side.

What We Never Set

• No analytics cookies. No pageview counters, no funnels.
• No advertising cookies. No ad networks, no retargeting pixels.
• No fingerprinting. No canvas tricks, no font lists, no battery readings.
• No third party cookies at all. Pages may load public images (like your OAuth avatar) and fonts directly from their hosts, but those hosts get no cookie from us and we get no report back.
• Browser-only storage (draft state, tour progress, this notice) stays in your localStorage and is never sent to us — except the console snapshot described in the Privacy Policy.

Clearing It

Clear site data or log out and the cookie is gone. Logging out deletes the session server side too, so the id stops working everywhere, not just in the browser you cleared.

Blocking all cookies breaks login and nothing else. The marketing pages read fine without a single byte stored.