Cookie Policy

Last updated: October 2026. This policy explains all cookies and similar storage (localStorage / sessionStorage) used on this site. You can change your choices at any time via .

How we ask for consent

A banner is shown on first visit (and again after 180 days or if you clear cookies). Until you interact with it, only strictly necessary storage is used. Your decision is stored in a first-party cookie named sm_consent (and mirrored to localStorage) for up to 180 days.

Cookie categories

Category	Name / Storage	Purpose	Duration
Necessary	`sm_consent`	Stores your cookie banner choices (JSON: version, telemetry, analytics, marketing flags). Set after you interact with the banner.	180 days
Necessary (user auth)	`sm_user_session`	HttpOnly, Secure, SameSite=Lax session cookie. Contains an HMAC-signed session reference (no personal data in the cookie value itself). Set after successful login or Google OAuth. Used to keep you authenticated across requests.	7 days (or logout)
Necessary (admin only)	`sm_admin`	HttpOnly session cookie for the private admin dashboard. Set only after a correct admin password is entered.	8 hours
Telemetry (optional)	sessionStorage `visitor-id`	Random UUID so your globe beacon stays stable within the browser tab. Sent to `/api/presence` only with your consent. Cleared when the tab closes.	Session (tab lifetime)
Analytics (optional)	—	Placeholder. No analytics script is active until a tool is added and you opt in.	—
Marketing (optional)	—	Placeholder. No advertising pixels are active until a tool is added and you opt in.	—

Google OAuth and Google Fonts

If you use "Sign in with Google", you will be redirected to Google's own sign-in page. Google may set its own cookies during this process, governed by Google's Privacy Policy. We do not control those cookies. The OAuth state parameter we use is HMAC-signed to prevent CSRF; it is passed in the URL and not stored in a cookie on our end.

Webfonts served from Google Fonts CDN may cause your browser to send a request to Google's servers (including your IP address). You may block this with a browser content blocker.

Related first-party API calls (not cookies)

With telemetry consent, the site calls /api/geo (Cloudflare edge location) and /api/presence (heartbeat for the live globe). No third-party IP lookup APIs are used — all geo data comes from Cloudflare's edge metadata.

Browser controls

You can view and delete cookies via your browser's developer tools or settings. Deleting the sm_user_session cookie will log you out. Deleting sm_consent will reset the cookie banner. Blocking all cookies may break authentication and repeatedly show the banner.

Do Not Track