Cookies and local storage

In force since 29 July 2026

There is no cookie banner on this site because there is nothing here to negotiate: we set no analytics, advertising or profiling cookies of any kind. What follows is the complete list of what a browser actually ends up holding, and why.

Set by PraxisOS itself

Nothing, on a first visit. We run no analytics product and no advertising tags. Once you are signed in, the application stores your light/dark preference locally so the page does not flash the wrong theme on load.

theme

Local storage, not a cookie. Remembers whether you chose the light or the dark appearance. Stays until you clear your browser storage. Never sent to a server.

Set by our authentication provider (Clerk)

These make signing in work: they say whether a session exists and carry the token that proves it. They carry no analytics or advertising function. They are currently set site-wide, including on pages such as this one that have no sign-in on them, because the authentication library initialises once for the whole application rather than per page.

__client_uat
__client_uat_<suffix>

First-party. Records whether a session exists and when it last changed, so the app knows whether to try to restore one. Session-scoped.

__clerk_db_jwt
__clerk_db_jwt_<suffix>

First-party. The session token itself. Session-scoped.

__clerk_environment

Local storage, not a cookie. A cached copy of the authentication instance’s configuration, so the app does not refetch it on every page.

Set by Cloudflare

Cloudflare sits in front of our authentication provider’s domain and in front of the challenge that protects the sign-up form. These are bot and rate-limiting controls; they do not identify you and are not used for advertising.

__cf_bm

Third-party, on the authentication provider’s domain and on the challenge domain. Distinguishes automated traffic from people. Around 30 minutes.

_cfuvid

Third-party, same domains. Lets Cloudflare apply per-visitor rate limits. Session-scoped.

Turnstile

On the sign-up page only, a Cloudflare Turnstile challenge is loaded to keep automated sign-ups out. It runs no cross-site tracking and issues a one-time token for that submission.

Controlling them

Your browser can block or clear any of these. Blocking the authentication cookies will stop sign-in from working. There is no way around that, because the session is the cookie. Blocking the Cloudflare ones may make the sign-up challenge fail. Nothing on the marketing pages needs any of them in order to be read.

Changes

If we add a provider that sets something, it gets listed here in the same change that adds it. See also the privacy notice.