Cookies
Last updated
The short version
- OpenCtrl only uses cookies that keep you signed in and keep sign-in safe.
- Two small notes in your browser remember pop-ups and banners you've closed. They never leave your device.
- No advertising, analytics or tracking cookies, and nothing from other companies. That's why there's no cookie banner.
Cookies we set
These are set by our sign-in system only when you sign in (or start to). Signed out, browsing OpenCtrl sets no cookies.
authjs.session-token (on https: __Secure-authjs.session-token)
Keeps you signed in. Encrypted; holds your account ID only.
How long: 30 days, or until you sign out
authjs.csrf-token (on https: __Host-authjs.csrf-token)
Protects sign-in and sign-out forms from cross-site attacks.
How long: Until you close the browser
authjs.callback-url (on https: __Secure-authjs.callback-url)
Remembers which page to return to after signing in.
How long: Until you close the browser
authjs.pkce.code_verifier, authjs.state, authjs.nonce
Only while you sign in with GitHub or Google: secures that sign-in.
How long: 15 minutes, or until you close the browser
| Name | What it's for | How long |
|---|---|---|
| authjs.session-token (on https: __Secure-authjs.session-token) | Keeps you signed in. Encrypted; holds your account ID only. | 30 days, or until you sign out |
| authjs.csrf-token (on https: __Host-authjs.csrf-token) | Protects sign-in and sign-out forms from cross-site attacks. | Until you close the browser |
| authjs.callback-url (on https: __Secure-authjs.callback-url) | Remembers which page to return to after signing in. | Until you close the browser |
| authjs.pkce.code_verifier, authjs.state, authjs.nonce | Only while you sign in with GitHub or Google: secures that sign-in. | 15 minutes, or until you close the browser |
Stored in your browser
These live in your browser's storage, not in cookies, and aren't sent to us.
oc.support.v1
Remembers when the Support OpenCtrl pop-up and our other one-time tips were shown or closed, and how many pages and how much time passed (so they don't appear too often). Never sent to us.
How long: Until you clear site data
oc:collective-banner-closed
Remembers that you closed the Collective banner, so it stays closed for 30 days. Never sent to us.
How long: Until you clear site data
Service worker cache
Stores OpenCtrl's own scripts, styles, brand images and offline page so the installable app loads fast and works offline. No pages or account data.
How long: Until OpenCtrl updates or you clear site data
| Name | What it's for | How long |
|---|---|---|
| oc.support.v1 | Remembers when the Support OpenCtrl pop-up and our other one-time tips were shown or closed, and how many pages and how much time passed (so they don't appear too often). Never sent to us. | Until you clear site data |
| oc:collective-banner-closed | Remembers that you closed the Collective banner, so it stays closed for 30 days. Never sent to us. | Until you clear site data |
| Service worker cache | Stores OpenCtrl's own scripts, styles, brand images and offline page so the installable app loads fast and works offline. No pages or account data. | Until OpenCtrl updates or you clear site data |
Why there's no cookie banner
Privacy law (the EU ePrivacy rules and the GDPR, and the UK's equivalents) asks for your consent before a site stores anything on your device, except what's strictly necessary for a service you asked for. Everything above is either needed to sign you in securely, or remembers a choice you made (closing a pop-up or banner). So there's nothing to consent to, and a banner would only get in your way.
If we ever add something that isn't strictly necessary, we'll ask first, with "Reject" as easy as "Accept", and update this page.
Other websites
OpenCtrl loads no scripts, fonts, videos or trackers from other companies. Our fonts are served from openctrl.app. Uploaded images come from our own storage. The one exception: if you signed up with GitHub or Google and haven't uploaded your own photo, your profile picture is loaded from GitHub or Google, and only you see it in the menu. When you follow a link out to an app, a donation page or an AI assistant, that site's cookies and policies apply.
Your choices
You can delete cookies and site data in your browser settings at any time. If you block our cookies you can still browse, but you won't be able to sign in. Questions: hello@openctrl.app.