At a glance
- Session cookies support sign-in and are separate for user and admin accounts.
- Turnstile processes browser security signals on account forms.
- Advertising cookies, session replay, and optional analytics are not enabled.
This summary helps you navigate the document. Read the full text below.
About this policy
This policy describes browser storage used by HerDay Life’s account application. Read it with the Privacy Notice. Deployment-specific cookie behavior and provider settings must be checked before public release.
Account session cookies
HerDay stores session cookies so the server can recognize a signed-in account. In production the user session cookie name begins with __Host-herday-app-auth; a separately authorized admin surface uses __Host-herday-admin-auth. Local development names omit the __Host- prefix. Large cookie values may be split into numbered parts, and an authentication flow may also use a code-verifier cookie.
Production session cookies are restricted to their host, marked Secure and HttpOnly, and use SameSite=Lax. Their browser expiry may be refreshed by the authentication provider. Application authorization also checks whether the server session is still valid and enforces a maximum seven-day session age. A cookie’s presence alone does not grant access.
Signing out removes that browser’s application session cookies. Blocking essential cookies can prevent account access. No authentication secret should be copied from browser tools or sent to support.
Cloudflare Turnstile
Turnstile loads on protected account forms to distinguish human use from automated abuse. It processes browser and connection signals; see Cloudflare’s Turnstile privacy notice.
We do not enable Turnstile pre-clearance in the application code. Cloudflare’s cf_clearance cookie may be issued if pre-clearance is enabled in the provider dashboard. The final cookie inventory must reflect the actual dashboard configuration; this policy does not assume that it is enabled.
Optional tracking
No advertising, cross-site marketing, session replay, or optional product-analytics cookies are activated in this release. The application does not currently require an “accept all cookies” choice. Any future optional tracking must have an appropriate notice and consent controls before activation where required.
Your browser controls
You can inspect or clear stored site data in your browser settings. Clearing session cookies signs you out of that browser; it does not by itself delete your account or revoke sessions on other devices. Use the account’s security controls for session management, or contact us about account closure.