Legal

Cookie Policy

Every cookie this service sets, what it does and how long it lasts. All of them are first-party, and all but one exist so that signing in and submitting a form works at all.

Last updated August 24, 2026

Template — review by a qualified lawyer before production

This document is a starting point, not legal advice. It has not been reviewed by a lawyer, it is not tailored to any jurisdiction, and it may not satisfy the obligations that apply to your business. Have counsel review and adapt it before you rely on it.

Three values are still placeholders and must be replaced in src/config/brand.ts:

brand.legal.entityNameCurrently [Your registered company name] — the contracting party named throughout the document.
brand.legal.addressCurrently [Your registered business address] — the registered address for legal notices.
brand.legal.governingLawCurrently [Your governing jurisdiction] — the governing law and the courts that hear a dispute.

Overview

Every cookie Paddek sets is first-party — set by this site, readable only by this site. There are no advertising cookies, no cross-site trackers, no third-party tag managers and no fingerprinting scripts.

We group browser storage into three categories:

Strictly necessary — sign-in, CSRF protection and link-password unlock. These are actual HTTP cookies and cannot be switched off; without them you cannot sign in and forms cannot be submitted safely.
Preferences — your theme and small layout choices. These are kept in your browser’s local storage, not in cookies, and are never transmitted to us.
Analytics — first-party measurement only. Nothing in this category is set today; see below.

Strictly Necessary Cookies

These are the only cookies the service sets. All of them are HttpOnly where the value must not be readable by page scripts, all use SameSite=Lax, and all carry the Secure flag when the site is served over HTTPS.

Cookie	Purpose	Lifetime
authjs.session-token / __Secure-authjs.session-token	Your signed-in session. A signed JSON Web Token identifying the account; the server re-reads your role and status from the database every five minutes so a suspension takes effect without waiting for the token to expire.	30 days
authjs.csrf-token / __Host-authjs.csrf-token	Cross-site request forgery protection. Holds one half of a double-submit token that every sign-in and mutation is checked against.	Until the browser is closed
authjs.callback-url / __Secure-authjs.callback-url	Remembers the page you were trying to reach so you land back on it after signing in, instead of on the dashboard root.	Until the browser is closed
authjs.pkce.code_verifier, authjs.state (and __Secure- forms)	Set only while a Google or GitHub sign-in is in flight. They bind the response from the identity provider to the request that started it, which is what stops an attacker replaying someone else’s authorisation code.	15 minutes
lk_pw_<link id>	Records that you entered the correct password for one specific password-protected link, so you are not asked again on every visit. The value is an HMAC over the link id and an expiry time, so it cannot be edited to extend itself and cannot be moved to a different link.	12 hours

The link-password cookie is worth one extra note. Its signature covers the link id and the expiry time together, which means a cookie granted for one link does not unlock another, and editing the expiry in the cookie invalidates it rather than extending it. There is no server-side session record behind it, because the redirect path must not take a database round trip to discover that a visitor is already through the gate.

Preferences

Interface preferences are stored in your browser’s local storage rather than in cookies. That is a deliberate choice: a cookie is attached to every single request to the server, and none of this needs to be — your theme is a rendering decision made in your browser.

Local storage key	Purpose	Lifetime
theme	Whether you chose light, dark or system appearance. Read before the first paint so the page does not flash the wrong colour scheme.	Until you clear it
cookie-consent	Your answer to the consent banner, and when you gave it. Without it the banner would ask you again on every page.	Until you clear it, or until the categories change
Dashboard layout keys	Small interface preferences such as whether the dashboard sidebar is collapsed. They affect layout only and are never sent to the server.	Until you clear them

Because these never leave your device, clearing site data in your browser removes them completely and there is nothing on our side to delete.

Analytics

No analytics cookie is set today. The category exists so that if first-party, cookie-based measurement is ever added to this site, it starts switched off and stays off until you turn it on.

Link and Bio Page analytics — the numbers a customer sees in their dashboard — are recorded entirely on the server from the request itself. No script runs in the visitor’s browser and no identifier is written to their device. The row we store holds no IP address; unique visitors are counted using a salted hash that rotates every 24 hours and differs for every link, so it cannot follow anyone across days or across links. The Privacy Policy describes exactly what is recorded.

The Redirect Path Sets No Cookie

When someone follows one of your short links, the server resolves the destination and answers with an HTTP redirect. Nothing is written to the visitor’s browser, no script is executed, and no identifier is planted that any other site could read. The click is recorded after the response has already been sent, so measurement never delays the redirect.

The single exception is a link you have password-protected: after the visitor enters the correct password we set the lk_pw_<link id> cookie described above, so they are not challenged again for twelve hours. That cookie is scoped to one link, is not readable by scripts, and carries no information about the visitor.

Interstitials — the password prompt, the preview page, the expired-link page — are ordinary pages on our domain and follow the same rules as the rest of the site.

Managing Your Choices

You can change your answer to the consent banner at any time. Rejecting optional storage does not degrade anything you can see today, because nothing optional is currently in use — it simply records the decision for the future.

You can also clear or block cookies in your browser settings. Blocking the strictly necessary cookies will stop you being able to sign in and will prevent password-protected links from staying unlocked; nothing else on the site depends on browser storage.

Changes to This Policy

If we add a cookie or a storage key, it will be listed here before it is used, and the date at the top of this page will change.

If we add a new optional category, stored consent from the previous version is discarded and the banner asks again. A decision you made about analytics is not treated as a decision about something that did not exist when you made it.

Contact

Questions about this policy: [email protected]

See also the Privacy Policy and the Terms of Service.

01Overview

02Strictly Necessary Cookies

03Preferences

04Analytics

05The Redirect Path Sets No Cookie

06Managing Your Choices

07Changes to This Policy

08Contact