Cookies and browser storage

What this notice covers

This notice describes browser storage intentionally used by AntiCode, operated by Rashad Elkersawy. Cookies, local storage, and session storage have different lifetimes and purposes. For questions about them, contact privacy@anticode.app. The privacy notice explains the associated account and repository processing.

Sign-in cookies

Supabase authentication uses cookies for your sign-in session and the verification steps in the login flow. Their exact names and expiry settings depend on the deployed authentication configuration; a complete provider-cookie inventory is still being confirmed.

AntiCode's anticode_auth_continuation cookie remembers the requested destination and whether you chose login or signup. It lasts up to ten minutes and is cleared when the callback finishes. It contains navigation information, not a provider access token.

CodHub account-linking and repository authorization use short-lived, encrypted, HttpOnly continuation cookies for up to ten minutes. These bind authorization to the signed-in account and transaction; pending linking data can include encrypted provider tokens until you confirm or cancel. They are not readable through page JavaScript. Server-side one-use records prevent completed transactions from being reused.

When Cloudflare-owned sign-in is enabled, separate Secure, HttpOnly, host-only cookies bind the AntiCode session, browser context and short-lived provider transactions. Server-side one-use records and current browser generations fence callbacks. These authentication cookies are separate from display preferences. Resetting display preferences does not sign you out or disconnect a provider.

Interface preferences

Local storage remembers whether the sidebar is collapsed. This preference has no application-set expiry and remains until it is cleared. Session storage remembers repository, author, date-range, and timezone filters for the signed-in user within the browser session.

These display preferences are separate from account settings saved on our server. Clearing one does not necessarily clear the other.

In a regular website browser, selecting English or German changes the current page without saving a language preference by default. Remember my language on this browser is an explicit choice in this page’s display preferences. When it is on, anticode.language in local storage and the anticode_language cookie remember your language. The cookie lasts up to one year; local storage has no application-set expiry. The anticode.language.remember.v1 local-storage value records on or off without an application-set expiry. When remembering is off, earlier saved language values are removed and language changes stay on the current page. An explicit lang link selects that page’s language without itself enabling remembering. Earlier saved language values can still select the initial language until you turn remembering off or reset display preferences.

Theme selection uses anticode.theme; animation pause uses anticode.marketing.motion. These local preferences have no application-set expiry and remain until cleared or replaced. The installed Mac app synchronizes its language separately. The website’s remember and reset controls are unavailable in that native workspace; this website update does not change the installed app’s stored preferences.

Repository sync keeps account-and-connection-specific progress, counters and a cursor in local storage under anticode.codhub.repository-sync.v1. Pending manual review requests use anticode.manual-review.v1 with request and pull-request identifiers and the chosen engine so an uncertain request can be reconciled before retrying. Settled request entries are removed or updated. These records have no application-set time limit; clearing them does not delete the corresponding server records.

The public Review Story example keeps its sample notes, decisions and checklist marks only in the current page memory. They reset on reload and are not saved to browser storage, a personal notebook or an account.

The anticode_language cookie is host-only: it sets no Domain attribute. It uses Path=/ and SameSite=Lax, adds Secure on HTTPS, and uses Max-Age=31536000 for up to one year. Turning language remembering off removes the same host-only Path=/ cookie with Max-Age=0, SameSite=Lax and Secure on HTTPS. Browser restrictions can prevent a write or removal; the controls report an incomplete result.

Advertising and other providers

The current AntiCode application does not include an advertising-cookie feature. This does not mean that hosting or third-party sign-in services create no storage or operational logs. Their deployed storage inventory and lifetimes remain under review.

German device-storage rules distinguish consent from limited exceptions, including storage strictly necessary for a service expressly requested by the user. We do not claim that every interface preference is exempt merely because it is functional. The display controls on this page cover only the stated AntiCode display settings; they are not a complete provider-cookie consent centre or proof that the provider inventory is complete.

Your browser controls

In this page’s display preferences, turning language remembering off removes saved language values without changing the current page language. Reset display preferences turns remembering off, keeps the off choice in local storage, removes the website’s saved language, theme and motion settings and returns theme and motion to system preferences. It does not clear authentication cookies, sidebar settings, workspace filters, repository sync progress or pending review identifiers. It does not revoke provider access or delete account, notebook or review records. If browser storage is restricted, the controls report when removal could not be completed.

You can also inspect and remove site storage through your browser settings. Removing authentication cookies can sign you out or interrupt login. Browser-wide removal can affect records outside the display reset. Clearing browser storage does not delete server-side account, repository, or review records; contact privacy@anticode.app for those requests.

Contact fallback

If you cannot reach privacy@anticode.app, email admin@rtwochain.com and identify AntiCode in the subject.

References

• German TDDDG: Section 25 ↗