Privacy & cookies
No analytics, no ad trackers, and no external Google Fonts requests—only what it takes to sign you in, take payment, and deliver your copy.
Cookies this site sets
| Cookie | What it is for | Lasts |
|---|---|---|
| rs_at | Keeps you signed in on this site. Unreadable by scripts. | About an hour |
| rs_rt | Renews your sign-in without asking for the password again. Unreadable by scripts. | 30 days |
| rs_pkce | Finishes a Google or GitHub sign-in in the same browser that started it. Unreadable by scripts. | 10 minutes |
| rs_notice | Remembers that you closed the cookie notice. | 1 year |
| Cloudflare Turnstile | The bot check on the sign-in form. Set by Cloudflare, only on the account page. | Up to 30 minutes |
All of them are needed for the site to work, so there is nothing to opt in to.
What we store
| Email and password | Your account. Stored with Supabase; the password is stored hashed. |
| Google or GitHub sign-in | If you use it: your email, name, profile picture and account ID from that provider, stored with Supabase. No access to your Google or GitHub data beyond that. |
| Payments | Handled by Stripe on its own pages. We receive your plan and payment status, never your card. |
| Security and abuse prevention | Cloudflare processes connection metadata, including IP addresses. The site uses short-lived rate-limit counters and a hash of the email address used in sign-in attempts. The backend keeps current per-account request counters. |
| Your devices | A device key per computer, so one account runs on two devices. |
| Your code | Stays on your computer. The AI review sends what the agents read to the AI provider you chose, with secrets masked. |
Providers: Cloudflare (hosting, bot checks), Supabase (accounts), Stripe (payments), and Google or GitHub if you sign in with them.
Signing out clears the site session cookies, or you can clear cookies in your browser. Account and payment records are stored separately from browser cookies.