Cookie & Tracking Policy
Effective 15 June 2026 · Version 1.1
This policy explains the cookies and similar technologies that Giraffe (the "Service") uses. It operates alongside the Privacy Policy. The terms "Service", "Operator", and "User" are used as defined in the Terms of Use.
What cookies are
Cookies are small files a website stores in a browser. The Service uses them only to keep a User signed in and to remember preferences the User has set. The Service measures usage with cookieless analytics (see below), so it does not need analytics or advertising cookies.
Categories used
- Essential (always on; no consent required): the login session and security tokens (CSRF). The Service cannot function without these.
- Functional (set only when the User chooses a preference): minor preferences such as the selected theme/contrast. These are set as a result of an action the User takes, not by default.
- Analytics — cookieless (no consent required): the Service measures aggregate usage with Cloudflare Web Analytics, which sets no cookies and collects no cross-site or personal identifiers.
- Advertising: none. The Service sets no advertising or cross-site tracking cookies.
Because the Service sets only essential and functional first-party cookies — and no analytics or advertising cookies — no cookie-consent banner is shown.
The cookies we use
Names and durations are approximate and may change as the Service evolves; the categories above are authoritative.
| Cookie | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
authjs.session-token (or __Secure- prefixed) | Giraffe (Auth.js) | Keeps you signed in | Essential | Up to 30 days |
authjs.csrf-token | Giraffe (Auth.js) | Cross-site request forgery protection | Essential | Session |
gf-contrast | Giraffe | Remembers your theme / contrast preference | Functional | ~12 months |
Controlling cookies
The Service sets only essential and functional first-party cookies, and measures usage without cookies, so there is no consent banner to manage. A User may clear or block cookies in their browser settings at any time; blocking the functional cookie only resets a saved preference, and blocking the essential cookies will sign the User out.
Third-party cookies
The Service embeds no third-party advertising or social trackers. Essential cookies are set by the Operator and its infrastructure providers (e.g. Cloudflare at the network level) — see the sub-processor list in the Privacy Policy.
"Do Not Sell or Share" (California)
The Operator does not sell or share personal information and sets no advertising cookies; there is nothing to opt out of. This is stated explicitly because California law requires it.
Changes
The Operator may update this policy; material changes follow the same 30-day notice as the Privacy Policy. Questions: grievance@giraffe.land.