Cookie Policy

session_id (strictly necessary)

• Purpose: identifies your signed-in or anonymous session, so we know to show you your harnesses and not someone else's.
• Type: HTTP-only, encrypted, SameSite=Lax, Secure in production.
• Duration: 28 days for signed-in sessions, 24 hours for anonymous sessions.
• Consent: not required. This cookie is "strictly necessary" under PECR Regulation 6(4) and the EU ePrivacy Directive Article 5(3) exemption — without it, the service literally cannot work.

oauth_return_url (strictly necessary)

• Purpose: remembers which page you were on when you clicked "Sign in", so we can return you there after Google authenticates you.
• Duration: 10 minutes, then deleted automatically.
• Consent: not required (strictly necessary).

Google (sign-in flow)

When you click "Sign in with Google", Google sets its own session cookies on google.com. We have no access to these. Google's policy: policies.google.com/privacy.

Local storage

• UI preferences (panel widths, zoom levels).
• Unsaved work for users who haven't signed in (cleaned up after 7 days).
• Clipboard data for cross-window paste.

None of this is sent to our servers.

Session storage

• Which project the current tab is editing (so multiple tabs don't fight).
• Cleared automatically when you close the tab.

Desktop app

The Splice desktop app does not use cookies — it uses your operating system's secure storage to remember your sign-in. Functionally it's the same as the session_id cookie above and is covered by the same "strictly necessary" reasoning.