Cookie policy

Essential sign-in and security

After a successful sign-in, Castlune sets the essential HttpOnly cookie castlune_session. It contains a random session token, is protected with Secure and SameSite=Lax settings, and expires after 30 days unless renewed or removed earlier by sign-out. Castlune stores only a one-way hash of this token in its database.

Google sign-in and one-time email links through Supabase use short-lived OAuth/PKCE and return-path cookies during the authorization exchange. Castlune's Google return-path and provider cookies expire after about ten minutes; its email return-path cookie expires after about one hour; and temporary Supabase authentication cookies are cleared after the exchange. OpenAI Sites may set additional essential hosting and security cookies. Castlune uses a separate short-lived HttpOnly PKCE cookie named castlune_x_pkce for the X authorization flow. None of these cookies is used for advertising.

Session interface storage

The key castlune-moonrise-seen-v1 may be stored in browser session storage so the opening moon animation is not repeatedly shown in the same tab session. It is cleared when the browser session ends and is not used to track you across sites.

No advertising or analytics cookies

Castlune does not currently set advertising, cross-site tracking or optional analytics cookies. If non-essential analytics or marketing technologies are introduced, this policy and the interface will be updated and consent will be requested where required before activation.

Your controls

You can remove or block browser storage in browser settings. Blocking essential cookies may prevent sign-in and connected-account authorization from working. Global privacy controls are respected where they apply; Castlune does not currently sell or share data for targeted advertising.