Legal
Cookie Policy
Last updated: October 2026
Aurora uses the minimum cookies needed to keep you signed in and your preferences working. We do not use third-party trackers, advertising pixels, or analytics that follow you across the web.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| sb-pyijkmnhvpjhgigvdmxm-auth-token | Your Supabase auth session. Required to stay signed in. | 400 days (renewed while you use Aurora) | Strictly necessary |
| sb-pyijkmnhvpjhgigvdmxm-auth-token-code-verifier | PKCE code verifier that ties a sign-in started in this browser — GitHub / Google, an email confirmation link or a password-reset link — to this browser. Removed when that sign-in completes. | Until the sign-in completes (at most 400 days) | Strictly necessary |
| auth_next | Remembers which page to return to after you sign in (for example a team invite). | 10 minutes | Strictly necessary |
| aurora_ref | Set only when you sign up through a friend's invite link (and again at your first sign-in on another device), so that friend can be credited. Deleted once the referral is processed. | At most 7 days | Functional |
| aurora-theme | Remembers your theme choice. Kept in your browser's local storage, not a cookie — it is never sent to our servers. | Until you clear it | Functional (local storage) |
Everything above is first-party. The strictly necessary cookies keep you signed in and finish sign-ins you started; the functional items only remember your theme choice or a friend's invite link you followed. None of them is used for advertising, analytics or cross-site tracking, which is why we do not show a cookie banner.
Analytics without cookies
We measure traffic with Vercel Web Analytics and Vercel Speed Insights. Both are cookieless: they set nothing on your device, assign no persistent identifier, and are served first-party from /_vercel/ on this domain rather than from a third-party script host.
What they record is aggregate — page path, referrer, country, device type, and page-load timings. What they do not record: your IP address in a retrievable form, any cross-site history, or anything tied to your Aurora account — so measurement adds nothing to the list above.