Cookie Policy

Keeps you signed in: a signed session token, unreadable to scripts (HttpOnly). Deleted when you sign out; a stolen copy can be revoked server-side.

Ties a sign-in through Google, X or Telegram to the browser that started it, so the provider's answer cannot be completed in another browser. Holds only a hash, unreadable to scripts (HttpOnly). Exists only for the duration of one sign-in.

A random per-browser identifier used against fraud: to spot many accounts created from one browser and to restrict access from a browser involved in abuse. It is set when you sign in and stored on our side only as a hash.

Ties a Telegram sign-in to the browser that started it, so a forwarded login link cannot complete somewhere else. Exists only for the duration of one sign-in.

Remembers the language you picked in the header, so the next visit opens in it.

Holds a Google, X or Telegram sign-in you have started — or the account-linking round trip that runs the same way — as which provider it was, the one-time value that identifies the attempt, and where to return you, so the page you come back to can finish it and refuses anything this browser did not start. Lives in sessionStorage: it dies with the tab, or after 10 minutes.

Holds a Telegram sign-in you have started, so leaving for the Telegram app — or a reload while you are away in it — does not lose the confirmation half-way. sessionStorage, this tab only.

The partner code from an invite link, so registering days after following it is still credited to whoever shared it. localStorage; erased as soon as it has been used for one registration.