Cookies and local storage
What we store in your browser, what needs consent, how to change it.
Updated September 17, 2026
Septagram runs as a browser application, so almost everything it remembers is kept in your browser's local storage or session storage rather than in cookies. The law treats all of them the same way: what matters is that something is stored on your device, not what the storage is called. This page covers all of them.
This page is only about what is stored on your device. What we record on our own servers, and why, is explained in the Privacy Policy.
What we store
Strictly necessary. Keeps you signed in, remembers your language and interface settings, and records your privacy choice. These cannot be switched off and do not require consent.
| Name | Where | Purpose | Retention |
|---|---|---|---|
sb-…-auth-token | Local storage | Your signed-in session (Supabase authentication) | Until sign-out |
app_language | Local storage | Interface language | Until you clear it |
sg_cookie_consent, sg_consent_notice | Local storage | Records your analytics choice | Until you clear it |
app_theme, app_font_scale, week_start, tarot settings | Local storage | Interface preferences you set yourself | Until you clear them |
Analytics. Identifiers that link your visits from the same browser.
| Name | Where | Purpose | Retention |
|---|---|---|---|
sg_anon_id | Local storage | Random identifier linking visits before sign-in | Until you clear it or withdraw consent |
sg_session_id | Session storage | Groups page views into one visit | Until you close the tab |
sg_last_visit_ping | Local storage | Records a visit once per day, not on every page | 1 day |
Attribution. Where you came from — a partner link, a campaign, a search engine — so the right partner is credited when you sign up.
| Name | Where | Purpose | Retention |
|---|---|---|---|
septagram_ref, sg_ref_meta, sg_first_touch | Local storage with consent; session storage without | Partner code, click identifier, first landing page and campaign tags | Up to 60 days with consent, until you close the tab without it; deleted once you sign up |
Advertising. None. We run no advertising cookies, no advertising or social tracking pixels, and we do not sell data to advertisers.
Your choices depend on where you are
- EU, EEA, Switzerland, Brazil. Analytics and long-lived attribution storage are written only after you press Accept. Declining is one click, the same as accepting.
- United Kingdom and other regions. First-party analytics storage is on by default, as UK law allows for statistics used to improve a service. A notice tells you so on your first visit, and Opt out turns it off in one click.
- United States. First-party analytics storage is on by default. A Global Privacy Control signal from your browser is treated as an opt-out.
We work out which rules apply from your browser's time zone. You can change your choice at any time in Settings → Data and privacy. Withdrawing consent deletes the analytics identifiers from your browser.
Browser controls
You can also block or delete cookies and storage in your browser settings. Clearing them signs you out and resets your interface preferences; blocking storage entirely will break sign-in.