The cookie we set
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
codder_session | Keeps you signed in. Holds a random token, not your identity or any personal data. | 30 days, or 90 with “keep me signed in” | Strictly necessary |
The cookie is httpOnly (unreadable by JavaScript), Secure in production (sent only over HTTPS) and SameSite=Lax (not sent on cross-site requests). Only a SHA-256 hash of its value is stored server-side, so a database read does not yield usable sessions.
Why there is no consent banner
A strictly necessary cookie used solely to keep you signed in does not require consent under the ePrivacy Directive or GDPR. Because Codder sets no analytics, advertising or profiling cookies, there is nothing to ask you about.
Other browser storage
Codder does not store personal data in localStorage or sessionStorage. Interface preferences — such as your default reasoning mode and default project — are stored against your account on the server, not in your browser.
Bot protection
If bot protection is enabled on this deployment, the registration page loads a challenge widget from Cloudflare, which may set its own cookie for that check. Where it is not configured, no third-party resource is loaded at all.
Turning cookies off
You can block cookies in your browser, but Codder cannot keep you signed in without the session cookie, so the application will not be usable.
More
See the Privacy Policy for what is stored server-side and how to delete it.