Cookies
Two cookies, both necessary, neither used to track you. The notice at the bottom of the app the first time you arrive is telling you that — it is not asking permission, because none of this is the kind of storage permission is for.
Last updated 27 August 2026
The two cookies
| Name | What it does | How long |
|---|---|---|
| ne_session | Keeps you signed in. It holds a random token and nothing else — no name, no email, nothing readable. The server stores only a one-way hash of that token, so even a copy of the database yields no usable session. Marked HttpOnly, so no script on the page can read it, and SameSite=Lax, so it is not sent along with requests from other sites. | 30 days, or until you sign out |
| ne_oauth_state | Set for the few seconds you are away at Google signing in, and checked when you come back. It is what stops somebody else's sign-in being completed as yours. Cleared the moment the round trip finishes. | 10 minutes |
That is the complete list. Both are strictly necessary — the app cannot know who you are without the first, and cannot sign you in safely without the second.
What there is not
- No analytics cookies. No Google Analytics, no Plausible, no anything.
- No advertising or tracking cookies, and no third party setting cookies through this site.
- No session recording and no heatmaps.
- No cross-site profile. Nothing here follows you anywhere else, and nothing anywhere else follows you here.
Why the notice says so little
Consent is required for the cookies that are not necessary, and there are none — so the notice at the bottom of the app the first time you arrive has one job, which is to tell you what is stored before you have to come looking for this page. It is not a gate and it is not a choice dressed up as one: Accept and Essential only both dismiss it and neither turns anything off, because there is nothing optional here to turn off. It says that on the notice rather than leaving the second button to imply otherwise.
What is recorded when you press either is one entry in your browser’s local storage, cookie_consent, holding which button you pressed. It never leaves your device and it is never sent to the server — it exists so the notice does not come back, and so which button you pressed has an answer. Clear your browser’s site data and the notice returns, which is correct: a fresh browser has not been told anything yet.
Settings kept in your browser
Your preferences are not cookies — they never leave your device and are never sent to the server. They sit in your browser's local storage, which means they are per-browser: change the theme on your laptop and your phone keeps its own.
What is kept there: your light or dark choice and colour theme, your reduce-motion setting, miles or kilometres, whether the app opens on the map or the list, your default sort and audience, which categories are filtered in, your pin colours, and your chosen display name. A random device token is kept alongside them, which is how upvoting works before you sign in without counting one person twice, and cookie_consent — the record that you were shown the notice above.
Clearing your browser's site data removes all of that along with the cookies. Nothing is lost that matters: your account, your pins and your notes live on the server and come back when you sign in.
Turning them off
Every browser can block cookies, per site or entirely. Blocking these two costs you the ability to sign in — the app will still show you a map, but it can no longer tell who you are, so there is nothing on it that anybody shared with you.
If your browser shows a cookie from this site that is not one of the two above, that is worth telling me about immediately.
Report it