Essential session cookie
The __session cookie authenticates the signed-in user. It is HTTP-only, SameSite=Lax, uses Secure on HTTPS, and has a five-day maximum age. Server verification checks the signed cookie locally and the app revocation cutoff on the account row. Signing out on one browser clears its cookie. App password changes and the explicit all-browser sign-out action revoke earlier app sessions after fresh credential verification. Firebase console changes and external password resets are synchronized at the next session exchange or security action; existing cookies can remain usable until then or their five-day expiry. Separate extension credentials are not covered by this browser-session action.
Theme preference
The app-theme cookie remembers light or dark appearance for up to one year. It is not used for advertising or cross-site tracking.
What is not implemented
The current application does not implement advertising cookies, analytics cookies, cross-site behavioral profiling, or a marketing-consent cookie banner. If non-essential cookies are introduced, consent and rejection controls must be added before use.