Cookie policy

Last updated: June 11, 2026

Cookie policy

We collect the absolute minimum data required to operate. We do not use analytics cookies, advertising cookies, or third-party behavioral trackers.

The only cookies on this site are strictly necessary tokens designed exclusively to maintain your secure login session and prevent financial fraud during checkout.

Here's the complete list of every cookie we use:

Session cookie (session)

A strictly necessary cookie to manage your secure login session.

We explicitly omit timestamps from this cookie. Standard web cookies often stamp the exact time you log in, log out, or interact with an application. This metadata can be used to track your daily habits. By actively stripping this data, we ensure your activity timeline remains your private business. We cannot and do not track your behavioral metadata.

• Value: Reduced to just two essential components: a secure, encoded token used to verify your active web session, and a cryptographic server signature proving the data hasn't been tampered with. This design guarantees that even if someone were to inspect the browser data on your device, they'd be completely unable to infer when you logged in or your usage patterns.
• Expiration: Our server does not push a permanent expiration date. It functions as a true, non-persistent session token. It exists only in your browser's active memory and is permanently destroyed the moment you close the web browser.
• Security: Locked down with maximum security attributes: Secure (HTTPS only), HttpOnly (blocks client-side scripts), and SameSite=Strict (provides robust defense against Cross-Site Request Forgery attacks).

CSRF security token (csrftoken)

A strictly necessary security token used to protect our web application against Cross-Site Request Forgery (CSRF) attacks. It ensures that a malicious website cannot trick your browser into submitting unauthorized requests to our servers.

• Value: A unique, randomly generated cryptographic string. It contains no readable personal information and no user state.
• Expiration: Session. It exists only in your browser's active memory and is permanently destroyed the moment you close the web browser.
• Security: Secure (HTTPS only) and SameSite=Strict. (Note: Unlike the session cookie, this specific token intentionally omits the HttpOnly flag. This allows our secure web application to read the token and authorize requests.)

Payment security cookies (__stripe_mid, __stripe_sid)

Our checkout pages integrate with Stripe to process payments securely. This payment processor is the only third-party element on this site. Stripe sets cookies solely for fraud prevention, risk detection, and ensuring the security of your active transaction.

Machine identifier (__stripe_mid)

• Value: A unique, randomly generated machine identifier. It contains no readable personal information and is used exclusively by Stripe's automated systems to recognize returning devices and calculate fraud risk.
• Expiration: 1 year.
• Security: A strictly necessary security cookie managed entirely by Stripe's secure infrastructure.

Session identifier (__stripe_sid)

• Value: A temporary session identifier used by Stripe to maintain context during the active checkout process. This is required to securely route your transaction through banking verification flows like 3D Secure.
• Expiration: 30 minutes. It exists only for the duration of the active checkout session.
• Security: A strictly necessary security cookie managed entirely by Stripe's secure infrastructure.