Cookies and local storage
This page describes the main browser storage used by the current code. The production provider list and regional requirements still need review.
Updated:
Site login cookie
luma_session maintains your signed-in session for up to 7 days. Signing out clears the current cookie and revokes its server session. It uses HttpOnly and SameSite=Lax, with Secure on HTTPS deployments.
Google sign-in cookie
When Google sign-in is enabled, luma_google_flow associates a single sign-in attempt. It lasts up to 10 minutes and is scoped to /api/auth/google. The callback clears it on completion or failure.
Tab session storage
sessionStorage holds recovery information such as unsaved character inputs, list positions, chat image mode and pending request identifiers. Browsers normally clear it when a tab session ends, but session restoration varies by browser. Sign out and clear site data on shared devices.
Age declaration
luma-age-confirmation-v1 in sessionStorage remembers whether you confirmed being 18 or older or declined entry, for the current tab session. It contains no date of birth or identity document and is not sent to the server as proof of age. If browser storage is unavailable, confirmation applies only to the current page. Browser session restoration may retain the choice.
Analytics, advertising and third parties
The current frontend has no advertising tracking pixels or third-party analytics scripts. Payment checkout, Google and other external pages may apply their own storage rules. This notice is not consent to future analytics tools; adding tools requires a fresh review of disclosure and choice.
Your browser controls
You can clear or restrict this site’s cookies and data in browser settings. You may need to sign in again, and unsynced drafts or recovery identifiers may be lost. Formal grounds for each storage category and regional requirements still depend on the actual operating arrangements.
Operator and contact
- Operator
- Not yet published
- Operator location
- Not yet published
- Support email
- Not yet published. Do not send account details to unofficial addresses.
Operator and contact details must be completed before public launch.