Legal
Cookie Policy
Exactly which cookies, local storage, and similar technologies we use, and why.
Last updated: October 25, 2026
1. About this Cookie Policy
This Cookie Policy explains which cookies, browser storage, and similar technologies codeseed.app ("we", "us") uses when you visit codeseed.app (the "Service"), and why. It is a companion to, and should be read together with, our Privacy Policy (which covers personal data generally) and our Terms of Service. Where this Policy and the Privacy Policy's own cookie section (§10) overlap, this page is the more detailed, authoritative source.
Every technical claim on this page — cookie names, durations, and attributes — was verified directly against our application's source code, not assumed. Where we could not verify something (for example, the internal behavior of a third-party service we don't control), we say so explicitly rather than guess.
2. What Are Cookies?
Cookies are small text files a website can ask your browser to store, then send back on later requests to the same site — commonly used to keep you signed in, remember a preference, or measure traffic.
This Policy also covers two related browser technologies that work differently from cookies but raise similar privacy questions:
- ◆Local storage: data a site stores in your browser that persists indefinitely (until the site or you clear it) and is never sent to the server automatically — a site's own JavaScript has to read and send it.
- ◆Session storage: like local storage, but cleared automatically when you close the browser tab.
Unlike cookies, neither is sent with every request, and neither can be marked HttpOnly or Secure — those attributes are cookie-specific.
3. Strictly Necessary Cookies
These are the only cookies our own application code sets. They are strictly necessary for the Service to function — you cannot stay signed in without them — and under the ePrivacy Directive and GDPR, strictly necessary cookies do not require your consent. Both are set by Better Auth, our authentication library, when you sign in with GitHub.
better-auth.session_token (production: __Secure-better-auth.session_token)
Purpose: Identifies your logged-in session. This is what keeps you signed in as you navigate the app. Set by Better Auth when you sign in with GitHub; without it you would need to sign in again on every page.
Duration: 7 days, refreshed automatically (at most once per day) while you're active — so in practice it expires 7 days after your last activity, not 7 days after you first signed in.
HttpOnly: Yes — not readable by JavaScript.
Secure: Yes in production. Not set in local development over plain HTTP, where browsers reject the Secure attribute.
SameSite: Lax — not sent on most cross-site requests.
better-auth.session_data (production: __Secure-better-auth.session_data)
Purpose: A short-lived, signed cache of your session data, so most requests can confirm you're logged in without a database lookup.
Duration: Up to 5 minutes.
HttpOnly: Yes — not readable by JavaScript.
Secure: Yes in production. Not set in local development over plain HTTP.
SameSite: Lax — not sent on most cross-site requests.
We do not set a separate CSRF-token cookie. Cross-site request forgery protection on authentication comes from the SameSite=Lax attribute above (which stops these cookies being sent on cross-site requests) together with Better Auth's own origin validation, not a dedicated token cookie.
4. Analytics
We use a self-hosted, first-party website analytics script — not Google Analytics, Meta Pixel, or any third-party analytics vendor — served from our own analytics.codeseed.app subdomain. It loads only after you explicitly accept analytics.
4.1 What analytics receives
- ◆The script is loaded from https://analytics.codeseed.app/script.js after consent, tagged with a site identifier shared by all visitors to this site.
- ◆Its page-view requests may include the page URL and title, referrer, screen size, browser language, and hostname. Search-query strings and URL fragments are excluded by our integration.
- ◆A public GitHub handle can appear in the URL or title of a public profile page. We do not make custom analytics calls that send an account email address or private profile fields.
- ◆Analytics is self-hosted on our own infrastructure; it is not provided by an external analytics company.
4.2 Consent and withdrawal
Analytics is optional. We store your choice in local storage and do not load the analytics script until you select "Accept analytics." You can change your mind here at any time; rejecting analytics stops it from loading after the page reloads.
Analytics preference
Current choice: not selected.
5. Local Storage and Session Storage
We do not use session storage. We use the following local-storage entries to remember optional interface choices; they are not sent automatically with browser requests.
- ◆codeseed:analytics-consent:v1 — your analytics choice (accepted or rejected), kept until you change it or clear site data.
- ◆codeseed_favorites — project IDs saved by a visitor before signing in; removed after a successful sign-in sync or when you clear site data.
- ◆codeseed_onboarding_[user ID] — a flag that prevents the onboarding dialog from being shown again for that account, kept until you clear site data.
- ◆codeseed:claim-tour:v1:[claim ID] — a flag that prevents the claim workspace guide from being shown again, kept until you clear site data.
- ◆codeseed:submit-project-tour:v1 — a flag that prevents the project-submission guide from being shown again, kept until you clear site data.
- ◆email-banner-dismissed-at — a dismissal timestamp for the email-notification banner; used for seven days and kept until you clear site data.
6. Third-Party Cookies & Tracking
We do not use any advertising cookies, retargeting pixels, or cross-site tracking technology, from Google, Meta, or anyone else. Beyond that, here is exactly what we can and cannot confirm about the third-party services we do use:
- ◆GitHub (sign-in): signing in redirects you to github.com to authorize the app, then back to codeseed.app. Any cookie set during that step is set on GitHub's own domain, under GitHub's own cookie/privacy policy — not something codeseed.app sets, reads, or controls.
- ◆Website analytics: see Section 4. It is optional and loaded only after your consent.
- ◆Mistral AI (AI step verification) and our self-hosted database: these process data entirely server-side as part of handling your requests. Neither runs any code in your browser, so neither sets cookies or browser storage.
7. Managing Cookie Preferences
You can accept or reject optional analytics in the banner shown on your first visit, or use the controls in Section 4.2. Rejecting is as easy as accepting and does not affect access to the Service.
7.1 Browser controls
You can manage or delete cookies through your browser's own settings — every major browser lets you view, delete, and block cookies, either for all sites or per site. Deleting our session cookies (Section 3) will sign you out.
- ◆Chrome: Settings → Privacy and security → Cookies and other site data
- ◆Firefox: Settings → Privacy & Security → Cookies and Site Data
- ◆Safari: Settings → Privacy → Manage Website Data
- ◆Edge: Settings → Cookies and site permissions
Because our only necessary cookies are HttpOnly, they can be deleted through your browser's cookie settings but not read or removed via JavaScript from within a page.
8. Changes to This Cookie Policy
We may update this Cookie Policy as our use of cookies and similar technologies changes — including once the items flagged in Section 4.2 are resolved. When we make material changes, we will update the "Last updated" date above and post a notice in the platform's Changelog.
9. Contact
Questions about this Cookie Policy can be sent to privacy@codeseed.app. For data-subject rights requests, see our Privacy Policy (Section 11).