Draft — requires legal review.

This document has not been reviewed by a lawyer and is not in force. Highlighted items are facts still to be supplied.

Cookies

The cookies and browser storage Mortar's website sets, what each is for and how long it lasts.

Effective [[EFFECTIVE DATE]]

Cookies Mortar sets

These are all of them. Mortar sets no advertising or analytics cookies, and its pages load no third-party scripts.

__Host-mortar.sid

Set by
Control plane, in production
Purpose
Keeps you signed in, and remembers a sign-in you have started until the identity provider sends you back. Holds a random session id and its signature, nothing else.
Lasts
14 days after your last request; deleted when you sign out
Attributes
  • HttpOnly
  • Secure
  • SameSite=Lax
  • Path=/

mortar.sid

Set by
Control plane, in development only
Purpose
The same session cookie, under the name browsers accept over plain HTTP on a developer's machine.
Lasts
14 days after your last request; deleted when you sign out
Attributes
  • HttpOnly
  • SameSite=Lax
  • Path=/

mortar.theme

Set by
Website, or the page's script, when you switch between light and dark
Purpose
Remembers the theme you chose, so pages arrive in it. Holds light or dark. Without it, pages follow your system's setting; switching back to that deletes it.
Lasts
365 days
Attributes
  • Secure in production
  • SameSite=Lax
  • Path=/
  • Readable by the page's script

Stored by the page's script

Nothing. The page's script keeps nothing in your browser's own storage; the theme you choose is kept only in the mortar.theme cookie above.

Identity providers

When you sign in with GitHub, Google or Microsoft, that provider may set cookies on its own site under its own policy.

Your choices

The session cookie is needed to stay signed in; the public pages work without it. You can delete Mortar's cookies in your browser at any time, which signs you out and resets the theme. Questions go to [[PRIVACY CONTACT EMAIL]].