Cookie Policy

1. Overview
In short
Essential cookies keep you signed in, keep the Service secure and remember the state of what you are doing. They are always on. Analytics is off until you allow it. This page lists every first-party cookie by name, with its purpose and lifetime.
This Cookie Policy explains how TopoTopic uses cookies and similar technologies on topotopic.com. Cookies are small text files that your browser stores on your device. Under Austrian law (section 165(3) of the Telecommunications Act 2021, which implements the EU ePrivacy rules), storing or reading information on your device requires your consent unless it is strictly necessary to provide a service you have asked for.
We use two categories of cookies and device storage:
Essential: sign-in, security, your consent and acceptance records, and state that a feature you are using depends on, such as the conversation you are in or a display setting you chose. These are strictly necessary for the Service you request and are used without consent.
Analytics: optional usage and advertising measurement: our own first-party measurement, Google Analytics, Google Ads conversion attribution, and PostHog. Google receives measurement identifiers, events, and any available advertisement click identifier so that sign-ups and first sessions can be associated with advertisements. Advertising personalization stays disabled. Analytics scripts, their network requests and the analytics identifiers listed below stay off until you give analytics consent.
The Privacy Policy describes the personal data involved, and the Legal Notice / Imprint identifies who is responsible.

2. Consent and how to change it
On your first visit a consent banner offers "Accept all" and "Essential only" with equal prominence, and "Customize" to see both categories. Analytics is off until you choose otherwise. Your choice is stored in an HTTP-only consent cookie and in browser storage. It is also recorded on our servers when you enable analytics or when an analytics session already exists for your browser; an "Essential only" choice made in a new browser is stored in that browser only.
You can change or withdraw your choice at any time in Settings, Privacy, or through the cookie preferences control on public pages. Withdrawing analytics consent stops further analytics collection from that browser. It does not switch off essential cookies, and it does not delete analytics records collected while consent was given; those expire on the schedule in the Privacy Policy.
Consent is stored per browser and device. Changing it on one device does not change it on another. When you enable analytics the page reloads once, so that the browser security policy that blocks analytics endpoints can be replaced with one that permits them.
Accepting the Terms of Service or confirming that you have read this policy never enables analytics. Analytics consent is a separate choice.
We do not respond to browser "Do Not Track" or Global Privacy Control signals, and we do not read or record them. Analytics stays off unless you enable it, whatever those signals say.

3. Cookies we set
The table lists production cookie names. Most carry the __Host- or __Secure- prefix for additional protection, and all are set with the Secure flag and a SameSite restriction.
Cookie | Category | Purpose | Lifetime |
__Host-topotopic-session / topotopic-session | Essential | Signed-in session (HTTP-only). | Up to 60 minutes |
__Host-topotopic-refresh / topotopic-refresh | Essential | Session renewal token (HTTP-only). | Up to 7 days (30 days with remembered device) |
__Host-topotopic-browser-session-binding | Essential | Binds your session to this browser as a security check (HTTP-only). | Matches the renewal token |
__Host-topotopic-remember-device | Essential | Stores a remembered-device sign-in preference when you choose it (HTTP-only). | Up to 30 days |
__Host-topotopic-refresh-bridge | Essential | One-time marker that prevents sign-in redirect loops (HTTP-only). | 60 seconds |
__Host-topotopic-oauth-mfa | Essential | Carries a Google sign-in through the additional verification step when your account requires one (HTTP-only). | 5 minutes |
__Secure-topotopic-email-verification | Essential | Links your signup browser to the email verification step (HTTP-only). | Up to 48 hours |
__Secure-topotopic-email-verification-attempt | Essential | Carries a staged email-verification attempt through confirmation (HTTP-only). | 10 minutes |
topotopic_oauth_link | Essential | Binds a Google account-linking attempt to the signed-in account (HTTP-only). | 10 minutes |
__Host-topotopic-google-callback-canary | Essential | Verifies that a durable Google sign-in callback completed (HTTP-only). | Up to 60 minutes |
__Secure-next-auth.state / __Secure-next-auth.pkce.code_verifier | Essential | Protects Google OAuth authorization and callback integrity (HTTP-only). | 15 minutes |
__Secure-next-auth.callback-url | Essential | Returns you to the requested TopoTopic page after Google sign-in. | Browser session |
__Host-next-auth.csrf-token | Essential | Protects authentication requests against cross-site request forgery (HTTP-only). | Browser session |
webauthn-auth-challenge / webauthn-auth-state (and registration variants) | Essential | Passkey sign-in and registration ceremony state (HTTP-only). | 5 minutes |
webauthn-recent-auth-challenge / webauthn-recent-auth-state | Essential | Passkey confirmation before a sensitive action such as requesting account deletion (HTTP-only). | 5 minutes |
__Host-tt-consent / tt-consent | Essential | Stores your cookie consent choices (HTTP-only). | 180 days when accepted, 30 days when declined |
__Host-tt-legal | Essential | Caches which versions of the Terms, Privacy Policy and Cookie Policy you accepted, for faster checks (HTTP-only). The server-side acceptance record remains authoritative. | Up to 365 days |
__Host-tt-legal-proof | Essential | Short-lived signed confirmation of a just-completed acceptance (HTTP-only). | 15 minutes |
tt_surface | Essential | Stores an internal interface selection marker (HTTP-only). | Up to 30 days |
topotopic_bot_guard | Essential | Marks browser sessions to help identify automated traffic (HTTP-only). | 15 minutes |
vault_prefs | Essential | Keeps the Vault display settings you chose. | Up to 120 days |
topotopic-session-id | Analytics | Random analytics session identifier that keys first-party usage measurement when analytics is enabled. | Up to 30 days |
__Host-tt-analytics-session | Analytics | Signed copy of the analytics session identifier (HTTP-only). | Up to 30 days |
__Host-tt-acquisition | Analytics | Signed server-side record of how you arrived (campaign, referrer, landing page) for consented measurement (HTTP-only). | Up to 30 days |
topotopic-acquisition | Analytics | Script-readable copy of how you arrived (campaign, referrer, landing page). Written only after you enable analytics. | Up to 30 days |
topotopic-experiments | Analytics | Stores experiment assignment state. Written only after you enable analytics. | Up to 1 year |
consent-analytics-enabled | Analytics | Signals your analytics consent state to analytics scripts. | Matches the consent cookie |
_ga and _ga_* (Google Analytics) | Analytics (third party) | Google Analytics measurement identifiers. Set only after you enable analytics. | Up to 2 years (set by Google) |
_gcl_au and _gcl_aw (Google Ads measurement) | Analytics (third party) | Remembers the Google advertisement click that brought you here so we can measure which advertisements lead to sign-ups. Set only after you enable analytics. No advertising personalization. | Up to 90 days (set by Google) |
ph_* (PostHog) | Analytics (third party) | PostHog measurement identifier, set on our domain because PostHog requests are routed through it. Set only after you enable analytics. | Up to 1 year (set by PostHog) |
Consent cookie names used by earlier versions of the Service are migrated and cleared automatically.
Paid billing is not enabled. If it is enabled and you open a checkout or billing page, Stripe, the payment processor, sets its own cookies (for example __stripe_mid and __stripe_sid) to run the payment and prevent fraud. Google sets its own cookies on its sign-in pages when you choose Google sign-in.

4. Browser storage
Besides cookies, the Service uses browser storage (localStorage, sessionStorage and IndexedDB) on your device:
Consent record (essential): a copy of your cookie choice, so that the banner does not reappear on every page.
Sign-in support (essential): short-lived markers that coordinate sign-in, sign-out across tabs, and the legal acceptance check.
Settings you chose (essential): display settings, panel layouts, language and capture settings, dismissed hints, and per-conversation view state.
Recording support (essential): a random identifier for this browser as a recording device, which lets an interrupted recording reconnect to the same session.
Drafts and offline data (essential): messages you wrote that have not been sent yet, and an offline copy of your learning feed (IndexedDB).
Analytics support (consent required): analytics identifiers, first-visit attribution and deduplication markers, written only while analytics is enabled.
Request diagnostics (essential): a per-tab marker in sessionStorage that lets us correlate the requests of one tab when diagnosing an error. It is not used for analytics and disappears when the tab closes.
Error diagnostics (essential): error monitoring may briefly use sessionStorage to assemble a crash report.
The Service does not register a service worker and does not use the Cache Storage API.

5. Managing cookies in your browser
Most browsers let you remove or block cookies and clear site data. Blocking essential cookies prevents sign-in from working, and clearing site data shows you the consent banner again.
Questions about cookies and consent: support@topotopic.com.