Skip to content

Cookie Policy

Four cookies, all of them ours, none of them advertising. Here is exactly what each one does.

Last updated

The short version

Prompt Share sets four cookies. Three are required to sign you in and keep the session safe. One remembers which workspace you are using. That is the complete list.

There is no advertising cookie, no analytics cookie and no third-party cookie. The public marketplace loads no external scripts at all, which is enforced by a Content Security Policy rather than merely promised.

Because we set no non-essential cookies, there is no consent banner. A banner that asks permission for cookies we do not set would be theatre.

Every cookie we set

CookieWhat it doesCategoryLasts
accessTokenKeeps you signed in. HttpOnly — JavaScript cannot read it.Strictly necessaryShort-lived session
refreshTokenRenews your session without making you sign in again. HttpOnly, rotated on every use.Strictly necessary7 days
csrfTokenBlocks cross-site request forgery. Readable by our own JavaScript so it can be echoed back in a header — that is the double-submit pattern working as intended.Strictly necessary7 days
workspaceIdRemembers which workspace you are working in, if you belong to more than one. Verified against an active membership on every request, so it grants nothing on its own.Functional30 days

Browsing without an account

If you browse the marketplace without signing in, we set no cookies at all. View counting works without them — see how marketplace view counts work — using a one-way hash with a daily-rotating salt that cannot be reversed or correlated across days.

Local and session storage

One item of sessionStorage is used during sign-up: it remembers which page you were trying to reach so you land back there after verifying your email. It is cleared once used and never leaves your browser.

Controlling cookies

Your browser can block or delete cookies at any time. Blocking ours means you cannot stay signed in — the account gate on prompt bodies depends on the session cookie — but the public catalogue remains fully browsable.

Signing out clears the session cookies immediately.