Cookies and browser storage
The complete list of what this site writes to your device. It is short, because nothing here is written for advertising.
Last updated
Cookies we set
Seven in total. Six are strictly necessary and are set because a feature you used needs them. One is optional, and it is created only after you explicitly accept.
| Name | Set by | What it does | How long | Optional |
|---|---|---|---|---|
| gp_draft | This site | Carries an opaque handle so a draft written on one page opens in the editor. The text stays in server memory and is never written into the cookie. It is deleted as soon as you type in the editor or choose what to do with the incoming draft, and when you sign out or delete your account. | Until the draft is opened or refused, and 10 minutes at most | Necessary |
| gp_notice_account | This site | Remembers that you closed the account notice that sits at the top of every signed-in screen, so it is not shown to you again. It holds nothing but that closure and its own end date, and it is written only when you close the notice yourself. | 6 calendar months | Necessary |
| gp_analytics_choice | This site | Remembers whether you accepted or refused optional analytics, so you are not asked again. A preference, never a credential. | 6 calendar months | Necessary |
| gp_analytics_pause | Your browser | A local stop flag, written when you withdraw, so collection stops before the server has confirmed. | 6 calendar months | Necessary |
| genpolish_analytics | Our API | The measurement identity, and the only one. A random secret, created only after you explicitly accept analytics. | Up to 184 days | Optional |
| better-auth.session_token | Our API | Keeps you signed in to your account. | Up to 7 days | Necessary |
| genpolish.anonymous | Our API | Identifies an anonymous session and carries the free trial count for visitors without an account. | 30 days | Necessary |
The names change over HTTPS
Served over HTTPS, the last three take a prefix — either host-locked or secure-only. The prefix is enforced by the browser: it prevents a subdomain or an unencrypted page from writing over them.
Cookies we only delete
Four more names from our identity library may appear when you sign out, and only in order to be cleared. Our relay refuses to pass any of them through unless the value is empty and the lifetime is zero, so they cannot be used to store anything.
What else we store in your browser
Three keys, and not one more. Local storage holds the same analytics stop flag as the cookie above, so that blocking cookies cannot silently restart collection. Session storage holds pending payment intents during a checkout, and they are cleared when it ends.
The third is a safety net for your draft, and it is the only one that holds your text. When you write in the editor without being signed in, the draft is kept in session storage so that going to the sign-up or sign-in page does not lose it. It stays in that tab: it is never sent to us, it is not shared with your other tabs, and it disappears when the tab closes. It is erased as soon as the draft reaches our server, and as soon as you choose to discard it.
None of the three contains a result, an email address or a payment detail.
The notice, and what it is not
A small notice sits over the corner of the page until you answer it. It is there because the choice is yours to make, not because a cookie is already waiting: no measurement cookie is set on a first visit. Rendering a page, prefetching it or reading your current choice creates no analytics identity and no event, and there is no backfill once you accept.
It is not a cookie wall. Nothing behind it is dimmed, disabled or made inert, every tool works while it is open, and no page waits for an answer. Accepting and refusing are two ordinary form buttons of the same weight, one click each, and refusing closes no feature.
Changing or removing them
The controls are on the Privacy page, and on every page that shows the analytics panel.
Clearing the stop flag by hand does not restart collection. It is held in two places, and a read that fails is treated as a stop rather than as permission.