Cookie notice

1. Signing you in

Auth.js, the library that runs sign-in, sets a small number of cookies to make that work. All of them are strictly necessary — none are for advertising or tracking — and each is verified against a real sign-in, not assumed from documentation:

• —authjs.csrf-token — protects the sign-in form from cross-site forgery; set the moment you open it.
• —authjs.callback-url — remembers which page to send you back to once you're signed in.
• —authjs.session-token — keeps you signed in between visits; set once you actually sign in.
• —authjs.pkce.code_verifier — set only if you choose "Continue with Google", and cleared again a few minutes later once that sign-in finishes.

2. Remembering your theme

Your light/dark theme choice is remembered in your browser's own local storage, not a cookie, and never leaves your device.

3. Nothing else, for now

We don't run analytics, advertising, or third-party tracking scripts. If that ever changes, this notice — and a consent banner where one is required — changes first.