Last updated: July 14, 2026. A practical overview of how CanaryVaults uses cookies, session state, and related browser storage across public and authenticated flows.
This page is written as an operator-facing summary rather than a long legal document so users can understand why storage exists in the first place.
Three first-party cookies keep you signed in: canaryvaults_session, canaryvaults_session_token, and canaryvaults_session_refresh. All are HttpOnly and Secure, live at most 7 days, and are strictly necessary — the app cannot keep a session without them.
Some localStorage keys preserve interface choices such as tabs, toggles, or the last-used view so the product feels continuous. They never leave your browser except as part of the pages they configure.
A first-party analytics identifier (canaryvaults:analytics-session-id) is held in localStorage and sent with UX events to our own /api/analytics endpoint. No third-party analytics, advertising, or cross-site tracking scripts are loaded, and no analytics cookies are set.
Browser storage is only one part of the trust picture. Privacy, security, and support pages explain the rest of the product expectations.
