Cookies
There is no cookie banner on this site, and there is nothing hidden behind that. Commons sets no analytics cookies, no advertising cookies and no third-party cookies, so a dialog offering to refuse them would be refusing nothing.
Signed out, Commons sets no cookies at all. Signed in, it sets two, and both exist to keep you signed in. Nothing is kept in your browser’s local storage either.
Checked against the code when the processing register was last reviewed: 28 October 2026.
The complete list
| Name | What it does | How long | When you get it |
|---|---|---|---|
better-auth.session_tokenover HTTPS your browser shows it as __Secure-better-auth.session_token | Proves you are signed in. It holds a random token, not your name or your address. | 30 days, or until you sign out. | Only when you sign in. Signed out, it is never set. |
better-auth.session_dataover HTTPS your browser shows it as __Secure-better-auth.session_data | A short-lived copy of your own session, so most page loads do not have to re-read the database to find out who you are. | 5 minutes, then refreshed from the database. | Alongside the session cookie, for signed-in visitors only. |
better-auth.admin_sessionover HTTPS your browser shows it as __Secure-better-auth.admin_session | Holds an administrator's own session while they are viewing the platform as another account for support, so they can be put back afterwards. | Until the support session ends. | On the administrator's browser, never on yours. It exists so that acting as someone else is a temporary, reversible state rather than a second sign-in. |
All three are marked HttpOnly, so no script on the page can read them; SameSite=Lax, so they are not sent when another site links to us in a way that could act on your behalf; and host-only, so no subdomain can pick them up. Over HTTPS they are marked Secure.
Two cookies you might expect, and why they are not here
No cross-site request forgery cookie
The usual pattern is a token cookie paired with a hidden field. Commons protects forms a different way: the session cookies are SameSite=Lax so another site cannot make your browser send them on a request that changes anything, every action that changes something is a POST rather than a link, and the sign-in service checks the origin of every request it handles. That leaves nothing for a token cookie to add, so there is not one.
No “you accepted cookies” cookie
Remembering a choice takes a cookie of its own, which is the small absurdity at the heart of most banners. We have nothing to ask you about, so we store no answer. If that ever changes, the choice will be a real one, the cookie that remembers it will be listed in the table above by name, and the option to say no will work as easily as the option to say yes.
Why there is nothing else to set
Most cookie banners exist because a page loads things from other companies. This one does not, and each of those absences is a deliberate piece of the build.
- Map tiles are fetched by our own server and passed on. The map never tells a tile provider where you are looking.
- Type is whatever your device already has. There are no font files on this site at all, from us or from anyone.
- Statistics are counted on the server: which page, which day, roughly which country. No script runs in your browser to report a visit, and no identifier is attached to one.
- Videos and maps from elsewhere do not load until you click them. Until then the page shows a still placeholder and your browser has not contacted the provider. Clicking is the consent, and it is per video rather than a switch that covers the whole site.
- Light or dark follows your device setting, read at the moment the page renders. Nothing is remembered.
The one exception: the sign-in page
The sign-in page loads a small widget from challenges.cloudflare.com. It is called Turnstile and its job is to tell a person from a script. It is the only address other than ours that a page asks your browser for without being told to: the embedded videos above are the only other third party, and they wait for your click. Pages with neither a public form nor an embed are served with a policy that forbids third-party requests outright, so this is enforced rather than promised.
It sets no cookie, and it does not follow you between sites: there is no profile, no identifier kept, and nothing to opt out of. Cloudflare already hosts this site, so the widget adds no new company to the list of who touches your data. That is precisely why it is this widget and not one of the alternatives, which work by recognising you across the web.
It is there because sign-in emails a link to whatever address is typed into the form. Without a check, that form is a machine for sending mail to strangers in our name, and the people harmed are the ones whose addresses get used.
If you want more detail
The privacy page covers what we hold, why, and for how long, with the retention periods read from the rules the system actually runs.
The processing register is the Article 30 record in full, one entry per activity.
Your data page shows what we hold about you specifically, and lets you export or delete it without asking anyone.
You can also just block our cookies in your browser. Everything public on Commons works without them; you will not be able to sign in, which is the only thing they do.