Legal

Cookie Policy

Exactly which cookies, local storage, and similar technologies we use, and why.

Last updated: September 21, 2026

1. About this Cookie Policy

This Cookie Policy explains which cookies, browser storage, and similar technologies codeseed.app ("we", "us") uses when you visit codeseed.app (the "Service"), and why. It is a companion to, and should be read together with, our Privacy Policy (which covers personal data generally) and our Terms of Service. Where this Policy and the Privacy Policy's own cookie section (§10) overlap, this page is the more detailed, authoritative source.

Every technical claim on this page — cookie names, durations, and attributes — was verified directly against our application's source code, not assumed. Where we could not verify something (for example, the internal behavior of a third-party service we don't control), we say so explicitly rather than guess.

2. What Are Cookies?

Cookies are small text files a website can ask your browser to store, then send back on later requests to the same site — commonly used to keep you signed in, remember a preference, or measure traffic.

This Policy also covers two related browser technologies that work differently from cookies but raise similar privacy questions:

◆Local storage: data a site stores in your browser that persists indefinitely (until the site or you clear it) and is never sent to the server automatically — a site's own JavaScript has to read and send it.
◆Session storage: like local storage, but cleared automatically when you close the browser tab.

Unlike cookies, neither is sent with every request, and neither can be marked HttpOnly or Secure — those attributes are cookie-specific.

3. Strictly Necessary Cookies

These are the only cookies our own application code sets. They are strictly necessary for the Service to function — you cannot stay signed in without them — and under the ePrivacy Directive and GDPR, strictly necessary cookies do not require your consent. Both are set by Better Auth, our authentication library, when you sign in with GitHub.

better-auth.session_token (production: __Secure-better-auth.session_token)

Purpose: Identifies your logged-in session. This is what keeps you signed in as you navigate the app. Set by Better Auth when you sign in with GitHub; without it you would need to sign in again on every page.

Duration: 7 days, refreshed automatically (at most once per day) while you're active — so in practice it expires 7 days after your last activity, not 7 days after you first signed in.

HttpOnly: Yes — not readable by JavaScript.

Secure: Yes in production. Not set in local development over plain HTTP, where browsers reject the Secure attribute.

SameSite: Lax — not sent on most cross-site requests.

better-auth.session_data (production: __Secure-better-auth.session_data)

Purpose: A short-lived, signed cache of your session data, so most requests can confirm you're logged in without a database lookup.

Duration: Up to 5 minutes.

HttpOnly: Yes — not readable by JavaScript.

Secure: Yes in production. Not set in local development over plain HTTP.

SameSite: Lax — not sent on most cross-site requests.

We do not set a separate CSRF-token cookie. Cross-site request forgery protection on authentication comes from the SameSite=Lax attribute above (which stops these cookies being sent on cross-site requests) together with Better Auth's own origin validation, not a dedicated token cookie.

We verified this list directly against our authentication library's configuration and source (session settings, cookie attributes) and against every place our own code sets a cookie. Features we don't use — such as a "remember me" opt-out or linking a second OAuth provider to one account — have cookies defined in the library we depend on, but this application never triggers the code path that would set them, so they are not listed above as actually used.

4. Analytics

We run a self-hosted, first-party website analytics script — not Google Analytics, Meta Pixel, or any third-party analytics vendor — served from our own analytics.codeseed.app subdomain and loaded on every page of the Service.

4.1 What we can confirm from our own code

◆The script is loaded from https://analytics.codeseed.app/script.js on every page, tagged with a site identifier for our property (not a per-visitor identifier — the same value loads for every visitor).
◆Our own application code never passes it your name, email address, GitHub handle, or any other identifying field — we checked every place this script is referenced and every custom tracking call in our codebase, and there are none beyond the page-load script tag itself.
◆It runs on the same Hetzner (Germany, EU) infrastructure as the rest of our application, per our Privacy Policy §8 — not a separate third-party vendor's infrastructure.
◆It loads unconditionally, on every page, with no consent check beforehand — there is currently no logic anywhere in this application that gates it on user consent.

4.2 What we cannot confirm from this repository

The analytics script itself — the code that actually runs in your browser and decides what to collect and how — is served by a separate service we operate, whose own source is not part of this application's codebase. That means we cannot currently state with certainty, from this codebase alone:

◆Whether it sets any cookie.
◆Whether it writes to localStorage or sessionStorage.
◆Whether it derives or stores any persistent visitor identifier.
◆Whether it processes your IP address, and if so, whether that address is anonymized, truncated, or hashed before being stored, or stored as-is.
◆Exactly what request data it retains, and for how long.

We have not yet independently audited the analytics script's actual browser behavior or its server-side data handling. Until that is done, this Policy cannot claim it is cookieless or non-identifying — nor can it claim the opposite. See our report on this audit for what we recommend doing next.

4.3 Does this require your consent?

We cannot yet give a definitive answer. Whether prior consent is legally required under the ePrivacy Directive depends on exactly the facts in §4.2 that we cannot currently confirm — in particular, whether the script sets a cookie or persistent identifier for measurement purposes. If it does, consent would likely be required before it loads, and the current unconditional, every-page loading behavior would need to change. This Policy will be updated, and a consent mechanism added if needed, once that verification is complete.

5. Local Storage and Session Storage

Our own application code does not use browser local storage or session storage for tracking, analytics, or any other purpose. All authentication state is managed server-side via the cookies listed in Section 3 — we checked, and there is no localStorage or sessionStorage call anywhere in our own frontend code.

This does not cover storage that a third-party script we load might set on its own — see Section 6.

6. Third-Party Cookies & Tracking

We do not use any advertising cookies, retargeting pixels, or cross-site tracking technology, from Google, Meta, or anyone else. Beyond that, here is exactly what we can and cannot confirm about the third-party services we do use:

◆GitHub (sign-in): signing in redirects you to github.com to authorize the app, then back to codeseed.app. Any cookie set during that step is set on GitHub's own domain, under GitHub's own cookie/privacy policy — not something codeseed.app sets, reads, or controls.
◆Website analytics: see Section 4 — genuinely unverified, not asserted as cookie-free.
◆Mistral AI (AI step verification) and our self-hosted database: these process data entirely server-side as part of handling your requests. Neither runs any code in your browser, so neither sets cookies or browser storage.

7. Managing Cookie Preferences

codeseed.app does not currently have an in-app cookie consent banner or preference center. We are not going to describe one here as if it existed — see Section 4.3 for why one may become necessary, and this Policy will be updated if it is added.

7.1 Browser controls

You can manage or delete cookies through your browser's own settings — every major browser lets you view, delete, and block cookies, either for all sites or per site. Deleting our session cookies (Section 3) will sign you out.

◆Chrome: Settings → Privacy and security → Cookies and other site data
◆Firefox: Settings → Privacy & Security → Cookies and Site Data
◆Safari: Settings → Privacy → Manage Website Data
◆Edge: Settings → Cookies and site permissions

Because our only necessary cookies are HttpOnly, they can be deleted through your browser's cookie settings but not read or removed via JavaScript from within a page.

8. Changes to This Cookie Policy

We may update this Cookie Policy as our use of cookies and similar technologies changes — including once the items flagged in Section 4.2 are resolved. When we make material changes, we will update the "Last updated" date above and post a notice in the platform's Changelog.

9. Contact

Questions about this Cookie Policy can be sent to privacy@codeseed.app. For data-subject rights requests, see our Privacy Policy (Section 11).