Draft for review. This document has not yet been reviewed by a lawyer and may change before PostDooth’s public launch. Items in [brackets] are still to be completed.
PostDooth uses only what is strictly necessary to sign you in and keep you secure. We do not use advertising or analytics cookies, and no third-party trackers are loaded, so we do not ask for cookie consent.
What we store
- pd_refresh (cookie, set by api.postdooth.com): keeps you signed in. It is httpOnly (not readable by page scripts), sent only to our sign-in endpoints, and expires after 30 days or when you sign out.
- Sign-in binding cookies (short-lived, while you connect a social account): protect the connection flow against forgery.
- pd_session (browser storage): a simple “signed in” hint so the app knows to restore your session. It contains no token or personal data.
Changes
If we ever add optional cookies, we will ask for your consent first and update this page.