Cookies

ap_session. It holds a signed token identifying your account, nothing else. No name, no email, no browsing history. It is set when you sign in, lasts 30 days, and is deleted when you sign out.

It is http-only, so page scripts cannot read it; SameSite=Lax, so another site cannot make your browser send it; and in production it is sent over HTTPS only.

Consent is required for cookies that are not strictly necessary. This one is strictly necessary: without it there is no way to know you are signed in, and every page would sign you out again. A banner asking permission for a cookie you cannot decline and still use the service would be theatre.

There is no analytics cookie, no advertising cookie, no third-party cookie, and no tracking pixel. Nothing here follows you to another site or knows where you came from.

Photographs rendered into the previews are cached by your browser in the ordinary way, and the generated assets are cached on the server so the same image is not fetched twice. Neither identifies you.

You can block cookies for this site in your browser. Signing in will then stop working, which is the honest answer rather than a workaround. Everything you can see without an account, including the sample previews on the homepage and the pricing, works with cookies blocked.