Cookie Policy

__Secure-neon-auth.session_token

Keeps you signed in. It is the credential itself — the dashboard is inaccessible without it. httpOnly, Secure, SameSite=Strict, path /, domain .kodar.io. Set by the Kodar identity service when you sign in and deleted the moment you sign out; it also disappears when you end that device's session under Settings → Signed-in devices.

__Secure-neon-auth.local.session_data

A short-lived signed copy of your session (your name, address and whether it is verified) so rendering a page does not have to call the identity service every time. httpOnly, Secure, SameSite=Strict, path /, domain .kodar.io. 5 minutes, then re-minted from the session cookie above.

That is the complete list. The dashboard stores nothing in local storage or session storage either, and the public pages (landing, pricing, docs) set no cookies at all — you can read them without one.

Both cookies are scoped to .kodar.io, the parent domain, rather than to send.kodar.io alone. That is deliberate: your Kodar account is one identity shared by Send, Sign and kodar.io, so signing in to one signs you in to the others, and signing out ends the session everywhere.

The practical consequence, stated plainly because it is the most disclosure-relevant fact here: the session cookie is readable by every Kodar product on that domain. All of them are operated by the same controller named in our Privacy Policy, and the cookie is httpOnly, so it is never exposed to page scripts in any of them.

Strictly-necessary cookies — those required to deliver a service you asked for, such as keeping you signed in — need no consent under the ePrivacy rules. Both cookies above exist only to authenticate you: one is the session credential, the other is a five-minute cache of the same session so pages render without a round trip. Neither is used for measurement, profiling or advertising.

Nothing else is loaded that could set one: no third-party scripts, no analytics, no embeds, no ad pixels, and the brand webfonts are served from our own domain rather than Google Fonts. There is nothing to opt in or out of, so we do not interrupt you to ask.

You can clear or block cookies in your browser at any time. Blocking ours does not break the public pages, but the dashboard cannot keep you signed in without the session cookie — you would be returned to the sign-in screen on every request.

To end a session without touching your browser settings, sign out, or use Settings → Signed-in devices in the dashboard to revoke a specific device.