Cookies and local storage

Sign-in and security

egarots_login binds a code request to the browser that started it for up to 10 minutes. egarots_session authenticates the web session for up to 7 days unless you sign out or revoke it. Passkey and pairing operations also use temporary identifiers. Session cookies are HttpOnly, Secure over HTTPS, and SameSite=Strict.

These mechanisms provide sign-in and account security. Blocking them may prevent the account from working. Expiration does not mean every associated server record is immediately erased.

Preferences and transfers

Local storage remembers display, theme and sidebar preferences. IndexedDB may retain transfer-resume information and data needed for local features. Caches and downloads depend on the features used. The download service worker passes a stream to the browser’s download manager.

The web app keeps the unlocked vault key in memory, not in a cookie or localStorage preference. Clearing site data can remove preferences, transfer-resume information and local copies: preserve your recovery key and pending source files first.

Advertising and analytics

Egarots does not add advertising trackers or third-party audience analytics in this version. Cloudflare processes technical information needed for delivery, reliability and security. If optional tracking requiring consent is added, a separate choice must be offered before it is enabled.

Managing site data

You can inspect and clear egarots.app data in your browser settings. Signing out removes the session and locks access to the in-memory key; previously downloaded files remain on your device. Questions: privacy@egarots.app.