Cookie Policy
Last updated: August 31, 2026.
This policy describes the cookies, browser storage, and similar technologies PistonPost currently uses. Optional PostHog analytics stay off unless you allow them. Authentication, security, and preferences you request can still use the technologies listed below.
Cookies PistonPost can set
Better Auth cookie names normally start with pistonpost.. Secure production cookies add the __Secure- prefix. A large encrypted value can be split across numbered cookie chunks.
| Cookie name or pattern | Purpose | Typical lifetime |
|---|---|---|
pistonpost.session_token and _multi-* variants | Keeps the current account, and any additional saved sessions, signed in. | Up to 7 days, or the browser session when remember me is off. |
pistonpost.session_data and numbered chunks | Holds a short-lived encrypted session cache. | 5 minutes; stored as a session cookie when remember me is off. |
pistonpost.dont_remember | Tells the authentication system to use session-only sign-in cookies. | Browser session. |
pistonpost.two_factor | Completes a two-factor sign-in. | 10 minutes. |
pistonpost.trust_device | Remembers a device after you choose to trust it during two-factor sign-in. | 30 days. |
pistonpost.better-auth-passkey | Stores a temporary passkey challenge. | Browser session and cleared after the passkey flow. |
pistonpost.admin_session | Lets an authorized administrator return from an impersonation session. | Up to 7 days and cleared after returning from impersonation. |
better-auth.last_used_login_method | Remembers the sign-in method last used in this browser. | 30 days. |
pistonpost_cookie_consent | Records whether you allowed optional PostHog analytics. | 365 days after acceptance or 180 days after rejection. |
sidebar_state | Remembers whether you collapsed the navigation sidebar. | 7 days. |
Local storage
The theme local-storage entry remembers your light, dark, or system theme choice. It stays until you change it, clear site data, or remove it through your browser. PistonPost does not use local storage for persistent PostHog analytics identifiers.
The pistonpost.composer-draft.v1 entry saves text and post details for recovery for seven days after the last local save. It does not save selected images, videos, or upload progress. The pistonpost.local-account entry keeps that draft tied to your account. Signing out or changing accounts clears the previous account's draft.
Shared files and offline storage
When you share text, links, or images into PistonPost, the pistonpost-localIndexedDB database holds them on this device for up to one hour. It keeps at most three pending shares, each with up to 20 images and 50 MB of files. An anonymous share follows your first sign-in. Account changes clear shares belonging to the previous account. Adding or discarding a share removes its temporary record.
Shared images can contain their original metadata while stored locally. The composer cleans them before upload. Expired drafts and shares are removed when PistonPost next checks its local storage, so closing the app does not guarantee immediate deletion. Clearing site data removes this browser storage.
The service worker caches only a generic offline page and its styles and script. It does not cache feeds, account pages, API responses, or media for offline use. The offline page remains until replaced by an update or removed with site data.
Better Auth Sentinel fingerprinting
Better Auth Sentinel is a security service, not optional analytics. It derives a visitor identifier from browser and device signals, sends those signals and the current page URL to Better Auth Infrastructure, and attaches an identifier to authentication requests. This helps detect bots, credential stuffing, and suspicious sign-ins. Sentinel does not depend on your PostHog analytics choice.
The signals can include browser, platform, language, time zone, screen, hardware, font, canvas, WebGL, audio, plugin, storage-availability, automation, and network-connection characteristics. Sentinel also processes the network address and approximate location associated with the request. Read the Privacy Policy for more detail.
Optional PostHog analytics
If you accept analytics, PostHog receives pseudonymous page-view events using broad route categories such as post, tag, or profile. Temporary identifiers and standard browser or device properties may be included. Dynamic post IDs, tag names, usernames, page titles, referrers, query strings, and page content are removed before an event is sent.
PostHog uses memory-only persistence on PistonPost, so PistonPost does not set persistent PostHog analytics cookies. Autocapture, session replay, heatmaps, exception capture, person profiles, feature flags, and surveys are disabled. A browser Do Not Track signal also keeps this optional analytics off.
Cookie-free post-view processing
Post view counting does not set a cookie. PistonPost briefly processes the network address to create a one-way rate-limit key that reduces repeated counts. The post record keeps an aggregate total, not a list of viewers. Cloudflare Analytics Engine also receives aggregate post-view and operational events without a viewer identity.
Change your choice
When optional PostHog analytics is configured, you can reopen the preferences dialog and change your choice at any time. Clearing site data can sign you out and reset saved preferences.
Changes and contact
We may update this policy when the service changes. The date at the top shows when this version took effect. Questions about cookies or analytics can be sent to support@pistonmaster.net. You can also read the Terms of Service.