Only the cookie that keeps you signed in

• __Host-tfm_session keeps you signed in. It holds your account’s id, an expiry time, and a signature only our server can make, so it can be checked without a database lookup and cannot be forged or edited. It is set when Google sends you back to us after sign-in, lasts 30 days from that moment, and is removed when you sign out or delete your account. It is marked HttpOnly (no script on the page can read it), Secure (sent only over an encrypted connection), and SameSite Lax (sent only on ordinary navigation).
• tfm_oauth_state, tfm_oauth_nonce and tfm_oauth_next are set when you press “Continue with Google” and last ten minutes. They tie Google’s reply to the browser that started the sign-in and remember which page to return you to; without them a sign-in started elsewhere could be replayed into yours. They carry nothing about you.

During a sign-in Google sets its own cookies on Google’s pages, under Google’s privacy policy; those are not ours and we cannot read them.

If you use the light-or-dark switch in the footer, your choice is stored as one word in your browser’s local storage so the page opens the way you left it. Nothing reads it but the page you are on, it is never sent to us, and the switch clears it.

No analytics cookies, no advertising cookies, no third-party cookies, no tracking pixel, and nothing else in your browser’s storage. There is no analytics code in the app or in our emails, so nothing counts your visits or follows you to other sites. The emails we send carry no images, so opening one tells us nothing.

Cookie consent rules (the ePrivacy Directive as applied in Ireland and the UK) exempt cookies that are strictly necessary to provide a service you have explicitly asked for, and a preference you set yourself. Staying signed in to an account you created, and remembering the theme you chose, are exactly that. If we ever add a cookie that is not necessary, we will ask you before setting it, and this page will say what it is.

Signing out removes the session cookie. Your browser’s settings can delete any cookie at any time; the only effect is that you are signed out and will need to sign in with Google again. Blocking cookies for this site altogether means you cannot sign in.