Storage

One cookie, two keys, and a panel that checks.

A storage policy is easy to write and hard to keep honest, because the code moves and the page does not. This one is generated from the same declaration the app uses, and it ends with a panel that reads your browser and reports any disagreement.

Effective2026-08-02

Deployment facts are still an operator-and-counsel completion item. This public copy remains a draft template and is not final terms, a DPA, or a compliance representation.

01The short version

This site sets one cookie, and only when you are signed in: the session that keeps you signed in. It runs no analytics, no tag manager, no advertising pixel, and no third-party script of any kind. Everything else it keeps is in your browser’s local storage, and none of it identifies you to anyone else.

There is a choice bar, and it asks one real question. Necessary storage is not on it: a session cookie for a person who chose to sign in is necessary by definition, so asking permission for it would be asking permission for the thing you already asked for. What the bar does gate is analytics and performance, which is off by default and which this build does not use at all. The switch exists before anything is wired to it, so nothing can ever be measured on a visitor who has not agreed to it first.

02Cookies

One, and only while you are signed in. No third-party cookie, no tracking cookie, no advertising cookie, and nothing that follows you to another site.

sb-…necessary

Sign-in session

Holds the access and refresh token issued when you sign in, so a page reload does not sign you out. Written by the Supabase auth client, first-party, to this site only. The token proves who you are to the gateway and is scoped to your account. It is split across numbered cookies because a session is larger than one cookie holds.

Lifetime: Until you sign out, or until the refresh token expires.
If cleared: You are signed out and will need to sign in again.

It carries SameSite=Lax, so it is not sent when another site links to this one, and Secure, so it never crosses plain HTTP. It is first-party to this site and is read by this site only.

You do not have to take that on trust. The panel at the bottom of this page reads document.cookie in your browser and lists what it finds. Anything it finds that is not declared above is flagged as undeclared rather than explained away.

03What is stored locally

Every entry this build writes, with what breaks if you remove it.

verity-themepreference

Theme preference

Records whether you chose light, dark, or system, so the first paint after a reload is the theme you picked rather than a flash of the wrong one.

Lifetime: Until you clear it or switch back to system.
If cleared: The theme falls back to your operating system setting.

verity-customization-v1preference

Customize Verity preferences

Stores your working instructions, cosmetic choices, layout density, and sidebar pins on this browser. Working instructions are included with a new Chat request when the full Verity gateway is available; they are not stored as conversation messages.

Lifetime: Until you clear it or change the preferences.
If cleared: Verity returns to the Matcha palette, grain leather, editorial display face, roomy layout, and no pinned shortcuts.

verity-storage-noticenecessary

Storage notice

Records that you have read the storage notice, so it is not shown on every page load.

Lifetime: Until you clear it.
If cleared: The notice appears once more.

verity-theme-schemanecessary

Theme vocabulary version

Records which set of theme names your stored preference was written against, so a preference saved before the five material registers existed is migrated rather than silently resolving to nothing.

Lifetime: Alongside the theme preference, until you clear it.
If cleared: Your theme preference is re-read as if it were new, and an older name falls back to the default register.

verity-consent-v1

Your storage choices

Records which optional categories you agreed to, and when. Kept so the choice is not asked again on every visit, and so it can be shown back to you on this page.

Lifetime: Until you clear it, or until the meaning of a category changes, which invalidates it and asks again.
If cleared: The choice bar appears again on your next visit, and optional storage stays off until you decide.

The session cookie is named with a project identifier in it and is split across numbered parts, which is why it is listed as a prefix rather than an exact name.

04What asks for consent, and what does not

The ePrivacy Directive requires consent before storing or reading information on a device, with an exemption for storage that is strictly necessary to provide a service the user explicitly requested. A session token for a service you signed in to, a theme you chose, and a record that you dismissed a notice all sit inside that exemption.

The reasoning is worth stating rather than assuming, because the alternative is worse than useless. A banner that demands consent for necessary storage teaches people to click through dialogs without reading them, which makes the one dialog that should matter worth nothing.

Anything outside that exemption does ask, and the choice bar is where it asks. It carries one category today, analytics and performance, which is off by default and which this build does not use: the switch was built before anything was wired to it, so nothing can be measured on a visitor who has not agreed first. Refusing takes exactly as many clicks as accepting, and the decision can be changed at any time in Your choices below.

Anything optional added later will be off by default and will be declared on this page before it ships, under a category on that bar.

05Third parties

The marketing pages you are reading load nothing from another origin. Fonts are served from this deployment, the ambient background is generated in your browser rather than downloaded, and there are no embeds.

Inside the app, requests go to the deployment’s own gateway and to the authentication service. Model providers and any connectors you add receive data as part of doing the work you asked for, which is covered in Privacy §3. None of them set storage in your browser.

06Managing it

Use the panel below, or clear site data from your browser settings, which has the same effect. Clearing the session signs you out. Clearing the theme returns you to your operating system setting. Neither loses any work: everything you have made lives in your account, not in your browser.

Local storage is per browser and per device, so clearing here does not affect another machine you are signed in on.

07Your choices

08Inspect

These documents describe the software in this repository and the deployment you are reading them on. They are not legal advice. If you run your own instance, read them as a starting template and replace every operator slot before you put them in front of anyone. How the isolation is enforced.