Cookie Policy

These keep you signed in and the product secure. Blocking them will break sign-in and protected pages (/editor, /projects, /settings, /team, /billing redirect to /login without a session):

• better-auth.session_token — creator session cookie (Better Auth). Over HTTPS browsers receive it as __Secure-better-auth.session_token — both names are the same session. 30-day expiry with hourly refresh; read by page middleware and API session checks. Manage devices at Settings > Security > Sessions (revoke one or all others).
• ideoscreen.admin_session — separate admin-plane session cookie in its own identity namespace; a creator session can never become an admin session by client manipulation.
• 2fa_step_up — versioned HMAC step-up token proving a recent two-factor challenge; required alongside the session cookie on protected routes (otherwise redirect to the 2FA challenge page).

• NEXT_LOCALE cookie — remembers your language choice (English, Spanish, French, Arabic). Read server-side on each request; no routing or tracking attached. Spanish, French, and Arabic catalogs are machine-drafted and awaiting native-speaker review.
• idoscreen-theme — not a cookie. Theme (light/dark/system) is kept in browser localStorage and applied to the document root. Clearing cookies alone will not reset it; clear site storage or change it in the theme control.
• CSRF protection is a per-request header token fetched from GET /api/csrf ("x-csrf-token"), not a cookie. Consent choices themselves (analytics, marketing, AI training, third-party sharing, data processing) are stored server-side with timestamps, toggled at Settings > Privacy.

Verified against the codebase: no third-party advertising cookies, no analytics beacons, no social-plugin trackers, and no cookie-based theme storage. Cookie consent in the product today covers the five server-side purposes (analytics/marketing/AI-training/third-party-sharing/data-processing) plus the California do-not-sell switch — those toggles gate server-side processing, not browser cookies, because there are no optional browser cookies to gate yet. If marketing or analytics cookies are ever introduced, this policy and the consent gating must be updated and re-approved by counsel first.

Sign out to invalidate the session cookie; revoke devices any time at Settings > Security > Sessions. Change language with the in-app switcher (rewrites NEXT_LOCALE); change theme with the theme control (rewrites local storage). You may block cookies in your browser, but strictly-necessary cookies have no in-app opt-out because the service cannot function without them. Questions: the support form or support@videoscreen.app.