Cookie Policy

ScrollLaunch takes a minimalist approach to cookies:

• No advertising cookies.
• No third-party tracking cookies. Our analytics provider, Datafa.st, is cookie-free by design.
• No cross-site fingerprinting.
• Only a small set of strictly necessary first-party cookies for login and CSRF protection.

These cookies are required for the Service to function. They are set by us on the www.scrolllaunch.com domain and cannot be disabled without breaking sign-in.

• next-auth.session-token / __Secure-next-auth.session-token — your signed-in session. HttpOnly, Secure, SameSite=Lax. Lifespan: 30 days from last activity.
• next-auth.csrf-token / __Host-next-auth.csrf-token — CSRF double-submit token used by NextAuth. Session-only.
• next-auth.callback-url / __Secure-next-auth.callback-url — preserves the post-login redirect target. Session-only.
• next-auth.pkce.code_verifier — short-lived OAuth PKCE verifier. Cleared after sign-in completes.

We do not set third-party analytics or ad cookies. Specific third-party embeds only load when you take an action that uses them:

• Dodo Payments — when you open a checkout page, their domain may set cookies required to process the payment. Governed by their cookie notice.
• Google (OAuth) — Google sets its own cookies on accounts.google.com when you authenticate. Governed by Google's cookie notice.

We occasionally store small amounts of data in the browser's localStorage for UX reasons (e.g. remembering whether you dismissed an onboarding banner or which tab you had open on the dashboard). These are first-party, contain no personal identifiers, and can be cleared at any time from your browser settings.

Most browsers let you block or delete cookies via their settings. If you block strictly-necessary cookies, sign-in and checkout will not work. Useful links:

• Chrome cookie settings
• Firefox cookie settings
• Safari cookie settings
• Edge cookie settings