Private beta · 2026-10-06-draft
Cookie notice
These draft notices describe the current beta. They are not a lawyer-reviewed final policy. Contact the operator through your beta invitation for questions or requests.
koup uses first-party cookies and browser signals for authentication and trial-abuse protection.
01Authentication cookies
An httpOnly session cookie keeps you signed in, with a seven-day session lifetime. Auth.js also uses short-lived cookies for authentication security and redirects. Logging out revokes the session and removes the session cookie. Secure-cookie flags are enabled on HTTPS; the local development site runs on HTTP.
02Trial-abuse signals
A first-party httpOnly device identifier lasts up to one year. FingerprintJS computes a browser fingerprint for trial protection, with its monitoring disabled. IP address and network range are captured server-side. The API persists salted SHA-256 hashes for trial matching; raw sign-in signals remain in the server-side authentication session, not in JavaScript-visible session responses. See Privacy for matching windows and limits.
03Acceptance record
A short-lived, httpOnly first-party cookie carries the accepted legal draft version through sign-up or provider sign-in. It expires after one hour. Once identity is verified, the accepted version and acceptance time are stored with the authentication account. This is distinct from permission for optional advertising or analytics.
04Third-party checkout
Razorpay Checkout is loaded on the credit checkout page, not across the entire app. Its payment interface may use its own cookies or storage under Razorpay's policies. SMTP delivers sign-in codes and transactional emails; email is not used for browser tracking.
05Your controls
This milestone sets up no external analytics or monitoring service and no advertising-cookie consent system. Prometheus monitoring is local operational monitoring. You can remove or block cookies in your browser, but authentication and trial checks may then fail. Whether each signal requires consent or another lawful basis must be reviewed for your jurisdiction before production launch.