Cookies and browser storage

The short version

One cookie. It is essential: it keeps you signed in. There are no advertising, analytics or tracking cookies, and no third-party embed that would set one.

That means there is nothing optional to consent to yet, so the notice on this site states facts rather than asking you to accept anything. The preference infrastructure exists and defaults to refusal, so the first thing that would need consent cannot start before you give it.

The cookie this site sets

Name

One or more cookies ending -auth-token, prefixed sb-. Supabase splits a large session across numbered parts, so you may see more than one of them.

Set by

Supabase Auth, on this domain, when you sign in and when the session is refreshed. Nothing sets it while you are signed out.

Why

It carries your session so that loading the next page does not sign you out. It is not used to recognise you on other sites, and there is nothing to measure with it.

Attributes

Path=/, SameSite=Lax, Secure in production, and no Domain attribute, so it is sent only to this exact host. It is deliberately not HttpOnly, because the browser client has to read the session to keep the interface in step with it. That trade-off is listed as a known limitation on the security page.

Lifetime

As long as the session stays valid, refreshed as you use the app. Signing out clears it.

What this site does not load

• No third-party scripts or fonts. The page requests nothing from another origin: the fonts are downloaded when the site is built and served from this domain, so your browser never contacts a font service.
• No advertising or tracking pixels. There is no advertising technology, no cross-site tracker and no social embed.
• Error monitoring is compiled in, and switched off. The monitoring SDK is part of our own JavaScript rather than a script loaded from somewhere else, and it only initialises when a data source is configured - none is. Session replay is deliberately not enabled, because it would record architecture documents and interview answers, which is the content this product exists to treat carefully.
• One endpoint our pages do not call. Our host exposes a performance-measurement script on this domain, and it responds if fetched directly, but no page on the site references it, so no visit loads it. If that changes, this page changes first.

Browser storage that is not a cookie

None of these are sent to a server when you load a page. archknot_consent_v1 is where your choice about optional storage is recorded, and it lives in local storage rather than a cookie for exactly that reason: a cookie would be transmitted on every request, which turns a private preference into something the server sees.

Consent

archknot_consent_v1 - your answer to the notice on this site. Until you accept something it records a refusal, which is the default.

Project workspace

archknot_projects_store_v1 - the projects you create in this browser, kept so the workspace survives a reload. Projects you save also live in your workspace database; this is the copy the app reads first.

Legacy key

infrawrap_projects_store_v1 - from this product’s former name. It is read once to carry old data forward and never written again.

Optional storage and consent

The rule is that nothing optional runs before you have granted it, and it is enforced in the code that sends events rather than in the buttons that collect the answer. A measurement provider added later therefore inherits the restriction instead of having to remember it.

No such provider is connected today, so this section has nothing to switch off - and it says so rather than offering a control that would do nothing.

Nothing optional is running, so there is nothing to switch off. If that changes, this is where you will be able to turn it back off, and the preference is recorded under the browser key archknot_consent_v1. Until you have accepted something, that key records a refusal to accept.

Removing them

• Signing out clears the session cookie. Clearing your browser’s site data removes it too, along with the storage keys above.
• The session cookie is essential rather than optional: with it blocked, signing in cannot work. Everything outside the signed-in workspace still works without it.
• Nothing here follows you to another site, because there is nothing here that operates across sites.

Changes

The date at the top of this page changes whenever the text does. A change that affects what is stored, or who can read it, will be described here rather than folded silently into a revised date.