Legal
Cookies
Effective September 1, 2026
This is a short page because we use almost none. Regolyn sets no advertising cookies, no cross-site trackers, and no analytics cookies on the marketing site. That is why there is no cookie banner: there is nothing to consent to.
The cookies we set
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie (authjs.session-token) | Keeps you signed in to the application. Essential. | 30 days, refreshed while active |
| CSRF token (authjs.csrf-token) | Protects sign-in forms from cross-site request forgery. Essential. | Session |
Both are first-party, HttpOnly where applicable, and set only in the course of signing in. Blocking them in your browser will simply prevent sign in; the marketing site works without any cookies at all.
If this changes
If we ever add a category of cookie beyond essential, this page will say so first, the changelog will record it, and where consent is required we will ask for it properly, with decline as easy as accept.