Understand your choices
Cookies and browser preferences
Local implementation information · 27 October 2026
Cookies needed for access
Necessary cookies remember your age declaration, Terms acceptance and separate choice to allow answer processing. They also protect requests and support private access or optional sign-in. Confirming your age does not accept the Terms, allow answer processing or permit analytics. You make the two separate agreement choices on the first form used to create or join an alignment. A verified account can remember these choices across browsers while keeping the original acceptance dates. The remembered processing choice expires 30 days after you first grant it. Restoring it does not restart that period.
Your preferences
Preference cookies remember your appearance and any language you deliberately select. Appearance and the temporary design comparison also use local storage. Dismissing the continuation reminder is remembered in session storage for that tab. New questionnaire answers and reports are not saved in those browser stores. Older builds may have left access entries behind. Those entries are removed only after the app confirms an identity transfer or you clear storage on the device.
Optional analytics
A necessary cookie remembers whether you accept or reject optional analytics for up to 180 days. Accepting can create a separate random analytics identifier that lasts up to 24 hours. Rejecting or withdrawing permission removes it and stops later analytics sends. Accepting again creates a fresh identifier and never releases old queued events. You can use the core features after rejecting analytics. The app has no session replay, automatic pageview capture or browser analytics SDK.
Cookies and other browser storage
The names below identify storage keys, not the values stored in them. Necessary access cookies are limited to this host and cannot be read by page scripts (HttpOnly). They are marked Secure when using HTTPS and use SameSite=Lax. Page scripts can read preference cookies and the device-denial flag. A cookie can stay in your browser after server access expires or is revoked; the cookie alone does not keep that access active.
| Name or pattern | Storage | Purpose | Maximum lifetime |
|---|---|---|---|
sa.browser | Cookie | Keep this browser linked to its current private session when older responses arrive late. Separate from analytics. | 30 days |
sa.age | Cookie | Remember that you explicitly declared you are 18 or older. | 30 days |
sa.access | Cookie | Remember your separate Terms acceptance and choice to allow sensitive-answer processing. | 30 days from the original permission; restoring it does not restart the period. |
sa.privacy.receipt | Cookie | Remember the latest private removal receipt so you can check its limited status. It does not grant access to accounts or answers. | 30 days |
sa.privacy.case | Cookie | Remember the latest privacy request so this browser can show its status and next-step guidance. It does not grant access to accounts or answers. | 180 days |
sa.actor | Cookie | Let this browser resume its guest access. | Cookie: 30 days. Server access: up to 30 days, ending after 7 days of inactivity. |
sb-…-auth-token[.n] | Cookie | Support verified sign-in while keeping credentials out of page scripts. | Cookie: 30 days. Server access: up to 30 days, ending after 7 days of inactivity. |
sb-…-auth-token-code-verifier, sb-…-auth-token-flow-…-code-verifier, sb-…-auth-token-flows-code-verifier | Cookie | Check that a sign-in return belongs to the browser where it began. | Up to 30 days; normally removed after the sign-in return. |
sa.legacy.auth[.n] | Cookie | Support sign-in for original-version participations through server-managed cookies. | Cookie: 30 days. Server access: up to 30 days, ending after 7 days of inactivity. |
sa.csrf | Cookie | Help protect requests that change data from being sent by another site. | 24 hours |
sa.claim.… | Cookie | Link a short-lived account-connection or OAuth sign-in attempt to this browser. | 10 minutes |
sa.auth.context | Cookie | Check that an OAuth sign-in return still belongs to the browser session that started it. | 10 minutes |
sa.access.denied | Cookie | Keep private access blocked after this device declines entry, including when leaving offline. The flag does not identify a person. | 30 days |
sa.analytics | Cookie | Remember whether you allow optional analytics. Rejecting does not enable analytics. | 180 days |
sa.analytics.epoch | Cookie | Use a temporary random identifier for analytics you currently allow, without linking it to an account or participant. | 24 hours |
sa.theme, sa.locale | Cookie | Remember your appearance and any language you deliberately select. | 1 year |
sa.theme | Local storage | Remember your chosen appearance. | Until you change it or clear browser storage. |
sa.intimacy-view | Local storage | Remember whether you view intimacy questions one at a time or as a list. | Until you change it or clear browser storage. |
sa.design, sa.design.v11 | Local storage | Remember your temporary design comparison style. | Until you change it or clear browser storage. |
sa.reminderDismissed | Session storage | Remember that you dismissed the continuation reminder in this tab. | Until the tab’s session ends. |
salg.session.v1 | Local storage | Remember how to locate an original-version session. This alone does not grant access. | Until you change it or clear browser storage. |
salg.invite.… | Session storage | Keep an original-version invitation available in the tab where it was opened. | Until the tab’s session ends. |
sb-…-auth-token | Local storage | Hold sign-in proof left by an older build until transfer is confirmed, then remove that exact old identity entry. | Until transfer is confirmed or you clear browser storage. Server credentials can expire sooner. |
Terms revision sa-terms-2 · processing consent sa-sensitive-2. Earlier alignments retain their original question version.