Legal
Cookies
This document is not finished.
Why there is no banner
Consent is required for cookies that are not needed to provide the thing you asked for — analytics, advertising, and anything that builds a profile of you. This site sets none of those. Every cookie below is strictly necessary, which means a banner would be asking you to consent to something you cannot decline without breaking the site, while training you to click through the next one you see.
There is one measurement script — page-speed reporting, described in the privacy policy. It does not change the answer above, and the reason is narrow: consent rules of this kind are about storing or reading things on your device, and it stores nothing. No cookie, no local storage, no identifier. It also does not profile anyone or follow anyone between sites.
If anything is ever added that does store something for a non-essential purpose, or that builds a profile, a real consent mechanism has to ship in the same change — a banner that works before consent is given, a genuine reject, and nothing set until someone opts in. That is written down as a rule in the repository, not just an intention.
The six cookies
| Name | What it does | How long |
|---|---|---|
aliinuka_session | Keeps you signed in. It holds a random token and nothing else — no name, no email, nothing readable. It is set only after you sign in or create an account, is marked HttpOnly so scripts on the page cannot read it, SameSite=Lax so it is not sent from other sites, and Secure in production so it only travels over HTTPS. | 30 days, or until you sign out |
just-committed | Set for one moment after you post a commitment, so the next page knows to show the confirmation once. It holds the id of the commitment you just made. The page deletes it as soon as it has read it. | 60 seconds |
theme | Remembers whether you chose the light palette, the dark one, or to follow your device. It holds one of those three words and nothing else — no identifier, and nothing that says who you are. It is HttpOnly, so not even this site’s own scripts can read it; only the server does, before the page is sent, which is what stops the wrong palette flashing up first. | 1 year, or until you change it |
aliinuka_test_return | Only ever set for the site’s administrators, while they try the site in test mode: it holds their own sign-in’s random token, put aside so they come back to their own account when they leave. Marked HttpOnly, SameSite=Lax and Secure like the session cookie, and deleted when they leave test mode. | Until they leave test mode, at most 30 days |
aliinuka_demo | Only set if you open the live demo: it holds the number 1 and nothing else, and while it is there every page shows the demo’s sample member instead of you, with nothing saved. It is HttpOnly, SameSite=Lax and Secure in production, and “Leave” on the demo’s bar deletes it. | 1 day, or until you leave the demo |
aliinuka_demo_note | Only in the live demo, for a moment after you press something that would have saved: it holds 1, so the demo’s bar can say “Not saved”. The bar reads it and deletes it straight away. | 30 seconds |
Four things kept on the device, which are not cookies
The clock screen remembers which of its two countdowns you last made the big one. It is kept in your browser’s local storage under aliinuka.clock.primary, and it holds one of two words: task or day. Nothing else, and no identifier.
It never leaves your device. It is not sent to this site, it is not readable by anyone else, and it says nothing about who you are — only which way round you like a clock on the machine you are reading this on. Clearing your browser’s site data removes it, and the clock then starts on the task again.
The XP celebration remembers the last XP total this browser showed you, under aliinuka.xp.seen followed by your username, so that it knows when to pop up “+10 XP” or a rank-up — and so it shows each one once rather than on every page. It holds one number and nothing else, one for each account used on this browser, so one account’s total is never mistaken for another’s gain. It never leaves your device; your real total is kept with your account. Clearing it only means the next page skips one celebration.
The desk’s confetti remembers the last day it celebrated a finished set of quests, under aliinuka.desk.party, so that it falls once that day rather than every time you open the desk. It holds one date and nothing else, and never leaves your device. Clearing it only means one extra shower of confetti.
Only while you answer Chester’s first questions, before you have joined: your answers are kept in this browser tab’s session storage under aliinuka.welcome, so that reloading the page does not lose them. They are not sent anywhere until you tap “Join the club”, when they go with the join form; the entry is removed once your account has them, and the browser clears it anyway when you close the tab.
Only if you turn notifications on in settings: your browser keeps a service worker for this site (/sw.js) and the push subscription it made with its own push service. They exist because you pressed the button, and do one thing — show the notification you asked for. Nothing is registered by visiting, and turning notifications off removes the subscription. The worker caches nothing and sees none of your browsing. See the privacy policy.
What is not here
- No analytics cookies. The one measurement script here sets no cookie and stores nothing on your device — see the privacy policy.
- No advertising or retargeting cookies.
- No other local storage, and no other session storage — the four entries above are all of it. No service worker unless you turn notifications on.
- No cookies set by anyone other than this site — there are no embeds or iframes to set one.
- No font, map, video or social widget loaded from another company, so nothing that could set a cookie on their behalf.
Turning them off
Your browser can block cookies for this site. Blocking aliinuka_session means you cannot stay signed in, so the product will not work — but you can still read the public record, which needs no cookie at all.
See also the privacy policy, which covers everything else that is stored.