Cookies

Before you sign in

Nothing. Browsing the catalog, running a search and reading a listing set no cookie, no local storage and no identifier of any kind. There is nothing to accept or reject, which is why this site does not interrupt you to ask.

This is checked rather than claimed. An automated test signs no one in, requests a page, and fails if the response tries to set anything at all.

After you sign in

• ac_session keeps you signed in. It holds a random value with no information in it; everything about your session lives on the server, so signing out actually ends it.
• ac_refresh renews that session without asking for your password again. It is sent only to the one address that renews sessions and nowhere else.
• ac_mfa exists for a few minutes between your password and your second factor, and is consumed as soon as it is used.
• ac_csrf carries a value this site echoes back when you save something, which is how the server can tell a change you asked for from one another site tried to make in your name.
• ac_oauth (named __Host-ac_oauth on this site, which makes the browser keep it to this exact address) is set only when you choose to continue with Google or Apple. It lasts ten minutes and is used up when you come back, and it is how the server knows the answer from Google or Apple belongs to the sign-in you started.

All five are strictly necessary: without them signing in does not work. That is why they are set on the strength of you choosing to sign in rather than on a consent banner. None is used to follow you anywhere.

Four of the five cannot be read by scripts on this page. ac_csrf can, and has to be. The page reads it in order to send it back. It is not a key to anything: on its own it signs nobody in, because using it also needs ac_session, which no other site can cause your browser to send.

If that ever changes

Anything that is not strictly necessary has to pass through a consent check before it can store or send anything, and it defaults to off. If this site ever adds analytics, you will be asked first, the question will say what it is for, and declining will be a real answer rather than a delay.