1. What this policy covers
1.1 This policy explains what cookies and similar technologies (local storage, session storage) the detumble.ai website and web application (the "Service") place on your device, why, and how you can control them. It forms part of the Privacy Policy and the Terms of Service.
1.2 A cookie is a small text file that a website stores in your browser. Local storage is a similar browser feature that keeps data on your device without sending it to the server on every request.
2. Cookies and storage we use
| Name (may vary by version) | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
__Secure-authjs.session-token (or authjs.session-token in local development) |
detumble.ai | keeps you signed in after you use a magic link or Google sign-in | strictly necessary | 30 days, or until you sign out |
__Host-authjs.csrf-token |
detumble.ai | protects the sign-in form against cross-site request forgery | strictly necessary | session (deleted when the browser closes) |
__Secure-authjs.callback-url |
detumble.ai | remembers where to send you after sign-in | strictly necessary | session |
__Secure-authjs.pkce.code_verifier / state / nonce |
detumble.ai | secure the Google sign-in handshake (OAuth PKCE) | strictly necessary | a few minutes during sign-in |
| magic-link token (in the e-mail link, not a cookie) | detumble.ai | signs you in once when you click the link | strictly necessary | single use; expires after 15 minutes |
dt_run_controls (local storage, not a cookie) |
detumble.ai | remembers the run controls (effort mode, caps) you last used in this browser | strictly necessary; never sent to our server as a tracking signal | until you clear it |
dt_cookie_notice (local storage, not a cookie) |
detumble.ai | remembers that you have seen the cookie notice so it is not shown again; holds the single value ok |
strictly necessary (functional); never leaves your browser | until you clear it |
The session lifetime (30 days) and the magic-link validity (15 minutes) come from the Auth.js configuration in
apps/web/src/auth.ts; the local-storage keys come from apps/web/src/lib/run-controls.ts and
apps/web/src/components/CookieNotice.tsx.
All of these are first-party (set by detumble.ai for detumble.ai only). None of them is used to track you across other websites, to build a profile of you, or for advertising.
3. Analytics without cookies
3.1 We use Plausible Analytics to understand, in aggregate, how the website and app are used: which pages are visited, from which referrers, on which kinds of device and from which country, and how many sign-ups, sign-ins, runs and checkouts happen.
3.2 Plausible does not use cookies or local storage, does not store IP addresses or user agents, and does not track people across sites. It derives a daily-rotating hashed identifier from the visitor's IP address and user agent with a salt that is discarded every 24 hours, so that a visitor cannot be recognised from one day to the next. Plausible is an EU company and processes data in the EU.
3.3 Because no identifier is stored on your device and no personal data is retained, we do not ask for consent for analytics.
4. Third-party cookies on third-party domains
4.1 Google sign-in. If you choose to sign in with Google, Google sets and reads its own cookies on google.com during the sign-in flow. Those cookies are governed by Google's privacy policy, not by ours. We receive only your e-mail address, your Google account identifier and, if you allow it, your name and profile picture.
4.2 Payment checkout. When you buy a plan or a pack, you are taken to a checkout page hosted by our merchant of record (currently Polar). That page sets its own cookies on its own domain for security, fraud prevention and to complete the purchase, under the merchant of record's cookie and privacy policies. No payment cookies are set on detumble.ai.
4.3 Embedded content. Our website does not embed third-party video, maps, social widgets or fonts served from third-party domains that would set cookies. If we ever add such content, this policy will be updated first and, where consent is required, we will ask for it before loading it.
5. Cookies we do not use
We do not use advertising cookies, retargeting pixels, social media tracking pixels, session-replay tools, fingerprinting, or any third-party analytics that uses cookies. We do not sell or share data for behavioural advertising.
6. How to control cookies
6.1 In your browser. You can delete cookies and block new ones in your browser settings. If you block or delete the session cookie you will be signed out and will need to sign in again; if you block the CSRF cookie, sign-in will not work. Because we set no optional cookies, there is nothing else to switch off.
6.2 In the app. Signing out deletes the session cookie. Clearing site data in your browser removes local storage preferences.
6.3 Do Not Track and Global Privacy Control. We honour these signals by design: we do not track you whether or not they are set.
7. Cookies in our own tools
Our internal founder console and staging environments use the same session mechanism as the Service and no additional tracking.
8. Changes to this policy
If we add a cookie or a similar technology we will update the table above before it goes live and change the "last updated" date. If a new cookie requires consent under the law that applies to you, we will ask for consent before setting it.
9. Contact
Questions about cookies and general questions: support@detumble.ai (subject "Privacy")