RigLog

Cookie policy

Last updated 2026-09-16

Why there is no consent banner

RigLog sets 4 kinds of cookie and every one of them is needed for the app to work: staying logged in, and protecting the sign-in form. There are no analytics, advertising or tracking cookies, and no third-party scripts that set any.

Cookies that are strictly necessary to provide a service you asked for are exempt from the consent requirement in the ePrivacy Directive — but they still have to be disclosed, which is what this page is for. If that ever changes and a cookie is added that isn’t strictly necessary, this page will say so and you will be asked first.

The cookies

next-auth.session-token (__Secure- prefixed over HTTPS)Essential

Keeps you logged in. It holds a signed token identifying your account — without it every page would ask you to log in again.

Lasts: 30 days, or until you log out

next-auth.csrf-token (__Host- prefixed over HTTPS)Essential

Protects sign-in and sign-out from cross-site request forgery — it stops another site submitting those forms on your behalf.

Lasts: The browser session

next-auth.callback-urlEssential

Remembers which page to return you to after logging in.

Lasts: The browser session

next-auth.state / next-auth.pkce.code_verifierEssential

Set only if you sign in with Google. They tie the response from Google back to the request you started, which is what stops that exchange being hijacked.

Lasts: A few minutes, during sign-in only

Stored in your browser, but not cookies

A few things are kept in your browser’s local storage instead. They stay on your device, are never sent to the server, and are gone if you clear site data.

riglog-theme

Your light/dark/system choice (src/lib/theme.ts). Never sent to the server.

riglog-cookie-notice

Remembers that you have seen the cookie notice, so it stops reappearing.

riglog-trail-recording

A crash-recovery copy of a GPS track while you are recording one, so closing the tab by accident does not lose the run. Cleared once the run is saved.

Turning them off

Every browser lets you block or delete cookies. Blocking the ones above will log you out and stop you logging back in — the session cookie is the login. There is no way around that short of not having accounts.

Reading the public pages — this one, the homepage, the feedback board and public build pages — needs no cookies at all.

More about what RigLog stores is in the privacy policy.