Cookie policy
Last updated 16 October 2026
We use only the cookies needed to sign you in and keep your account safe. We do not use advertising, analytics or tracking cookies, and no other company sets cookies on our pages.
Cookies we set
| Name | What it is for | How long |
|---|---|---|
| next-auth.session-token | Keeps you signed in. It is encrypted: your browser cannot read what is inside. | Up to 7 days, and ends after 2 hours without activity |
| next-auth.csrf-token | Stops other websites from submitting the sign-in form for you. | Until you close the browser |
| next-auth.callback-url | Remembers which page to open after you sign in. | Until you close the browser |
| sxw_challenge | Holds your sign-in while you enter the 6-digit code. | 10 minutes |
| sxw_device | Remembers that this browser entered a sign-in code, so you are not asked every time. | 30 days |
On secure connections some names start with __Secure- or __Host-. That tells your browser to send them only over HTTPS.
Stored in your browser
We also keep two small settings in your browser's local storage: your light or dark preference (sx-theme), and the time of your last activity, so all your open tabs sign out together after 2 hours without activity.
Why there is no cookie banner
These cookies are strictly necessary: without them you cannot sign in. Because we use no optional cookies, there is nothing to accept or refuse. You can delete cookies in your browser settings at any time; you will then be signed out.
More
Read our privacy policy to see what data we keep and how to download or delete it.