What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They are widely used to make websites function correctly and to give operators basic session management capabilities.

Under the EU ePrivacy Directive and GDPR, we are required to inform you about the cookies we use and obtain consent where required. CordCat uses only strictly necessary cookies, cookies without which the platform would not function. No consent is required for these under EU law.

Cookie Details

token — set on login/registration. Contains a cryptographically random session identifier. The raw token is never stored on our servers; only its SHA-256 hash is stored in the database. The cookie is:

• HttpOnly: JavaScript cannot read it (prevents XSS theft).

• Secure (production): only sent over HTTPS.

• SameSite=Lax: not sent on cross-site requests initiated by third parties.

cc.csrf — set when you first visit. Used by our double-submit CSRF protection scheme. It contains a cryptographically random token that must be echoed in the X-CSRF-Token request header for all POST/PATCH/DELETE operations. The cookie is:

• HttpOnly: unreadable by JavaScript (the CSRF token value is separately delivered via a JSON endpoint to the page script).

• Secure (production): only sent over HTTPS.

• SameSite=Strict (production): never sent cross-site.

No Third-Party or Tracking Cookies

CordCat does not use:

• Advertising or marketing cookies.

• Analytics cookies (no Google Analytics, Hotjar, Mixpanel, etc.).

• Social media tracking pixels.

• Any third-party cookies whatsoever.

We run entirely on first-party, strictly necessary cookies. No cookie consent banner is required because we have no non-essential cookies.

Managing Cookies

You can clear, block, or manage cookies through your browser settings. Note that deleting the token cookie will log you out. The CSRF cookie is regenerated automatically on your next visit.

Browser-specific instructions:

• Google Chrome

• Mozilla Firefox

• Apple Safari

• Microsoft Edge

Contact

Cookie or privacy questions: [email protected]

Name	Purpose	Category	Duration	Flags
token	Session authentication — keeps you logged in between page loads	Essential	7 days	HttpOnlySecure
cc.csrf	CSRF protection — prevents malicious sites from submitting forms on your behalf	Essential	Session	HttpOnlySecure

Cookie Policy

What Are Cookies?

Cookies We Use

No Third-Party or Tracking Cookies

Managing Cookies

Contact