Cookie Policy

Two, both set by our identity provider (Neon Auth) and both strictly necessary. They are set when you log in — visiting the site or signing a document as an invited signer sets no cookie at all.

__Secure-neon-auth.session_token

Your session. This is what keeps you signed in; without it every page would ask you to log in again. HTTP-only and secure, so no script can read it.

__Secure-neon-auth.local.session_data

A short-lived signed copy of your session details so each page load does not have to call the identity service. It carries no more than the session cookie already establishes and expires within minutes.

On our production domains both are scoped to .kodar.io rather than to this site alone. That is deliberate: one Kodar login covers kodar.io, sign.kodar.io and send.kodar.io, so the session cookie is shared between them. It is a single-sign-on mechanism, not a tracking one — it identifies your session to Kodar and to nobody else.

No advertising cookies. No cross-site tracking. No third-party analytics or marketing pixels — the site loads no third-party scripts at all. We do not use browser local storage for tracking. Opening a signing link and signing a document set no cookie.

Because we only set strictly-necessary cookies, there is nothing to opt out of and no consent to give or withdraw. You can still clear or block cookies in your browser settings, though blocking the session cookie will prevent you from staying signed in. Signers, who get no cookie in the first place, are unaffected either way.

If we ever introduce non-essential cookies, we will add a consent mechanism and update this page before doing so.