Cookie Policy

1. How we ask

Cookies are small files a website stores in your browser. We use two kinds: strictly necessary cookies, without which rooms and sign-in cannot work, and functional cookies, which we set only if you allow them. We use no analytics, advertising or tracking cookies.

On your first visit a banner asks for your choice. Declining is exactly as easy as accepting, and until you answer only strictly necessary cookies are used. You can change your choice at any time with the settings above, through "Cookie settings" at the bottom of every page, or in your account settings. Your choice is kept for a year; if this policy changes in a way it did not cover, we ask again.

2. Strictly necessary: room cookies

When you create or join a room, we set an http-only cookie storing a random token that proves you are the host or a participant of that specific room. The name carries the room code and a scope segment — cmp_h_<scope>_<room code> for the host, cmp_p_<scope>_<room code> for a participant.

The scope segment is "anon" when you are not signed in, and otherwise a short one-way digest of your account identifier, so two people signing in on the same device never share a room's tokens and the cookie name itself reveals no identity.

These cookies cannot be read by page scripts, are scoped to the room they were issued for, and expire after 30 days.

3. Strictly necessary: sign-in and your cookie choice

These are set only if you choose to sign in. cmp_auth holds your identity, cmp_auth_t holds the tokens used to call our API on your behalf, and cmp_auth_id holds the token that lets us end your session cleanly when you sign out. All three are http-only, encrypted before they are written, and expire after 30 days.

cmp_auth_tx exists only during a sign-in handshake — it carries the one-time values that prove the response came back from the same attempt you started — and is deleted the moment you return from your provider, or after 10 minutes if you never do.

cmp_consent records the choice you made about cookies, so we don't ask again on every page. It lasts a year.

4. Preferences you set yourself

When you pick something by hand, we remember it because you asked us to: NEXT_LOCALE when you choose a language (until you close the browser), cmp_tz_<room code> when you choose a time zone for one room (one year), and cmp_tz_account, a copy of the time zone saved in your account settings (one year).

cmp_theme holds the theme you choose — system, light or dark — so every page is drawn in it from the first frame (one year). If you are signed in, the same choice is kept in your account and set here when you sign in on another device.

These are not http-only, so the page can read them to render correctly on first load. They only affect how information is displayed to you and are never sent to a third party.

5. Functional cookies — only with your consent

If you allow functional cookies, we also remember what we detect without asking: NEXT_LOCALE holds the language chosen from your browser's settings (until you close the browser), and cmp_tz holds the time zone your browser reports, used to show meeting times in your own clock (one year).

If you don't allow them, nothing is lost: your language is detected again on every page from what your browser sends, and meeting times may briefly appear in the room's own time zone before switching to yours. If you withdraw consent, we delete these cookies.

6. The sign-in server and providers

Sign-in pages are served by our own identity server, at its own address, which sets strictly necessary cookies for the duration of a sign-in or of your session there: AUTH_SESSION_ID, KC_AUTH_SESSION_HASH, KC_RESTART, KEYCLOAK_IDENTITY and KEYCLOAK_SESSION.

Google, Yandex and VK set their own cookies on their own sites when you sign in with them, under their own cookie policies.

7. Payment pages

When you pay for Pro you are taken to YooKassa or lava.top, which set their own cookies on their own sites under their own policies. We receive none of them.

8. What we don't use

No analytics, advertising or third-party tracking cookies, no tracking pixels, and no cross-site tracking of any kind. Your browser's local and session storage hold only conveniences that stay on your device and are never sent to us: answers and a room you haven't sent yet, so a reload doesn't lose them, and how you left a few controls on screen. An unsent draft is deleted once you send it, and after a week at the latest. The service's own operational metrics are collected on our servers and need no cookie.

9. Managing cookies in your browser

You can also block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop the room-answering and results features from working and keep you from staying signed in; blocking the others only means we detect your language and time zone again.

10. Contact

Questions about this policy can be sent to arthur.vafin.post@gmail.com.