Cookie Policy

1. Overview
In short
Essential cookies keep you signed in, keep the Service secure and remember the state of what you are doing. They are always on. Analytics is off until you allow it. This page lists every first-party cookie by name, with its purpose and lifetime.
This Cookie Policy explains how TopoTopic uses cookies and similar technologies on topotopic.com. Cookies are small text files that your browser stores on your device. Under Austrian law (section 165(3) of the Telecommunications Act 2021, which implements the EU ePrivacy rules), storing or reading information on your device requires your consent unless it is strictly necessary to provide a service you have asked for.
We use two categories of cookies and device storage:
Essential: sign-in, security, your consent and acceptance records, and state that a feature you are using depends on, such as a recording in progress or a display setting you chose. These are strictly necessary for the Service you request and are used without consent.
Analytics: optional usage and advertising measurement: our own first-party measurement, Google Analytics, Google Ads conversion attribution, and PostHog, including masked session replays. Google receives measurement identifiers, events, and any available advertisement click identifier so that sign-ups and first sessions can be associated with advertisements. Advertising personalization stays disabled. Analytics scripts, their network requests and the analytics identifiers listed below stay off until you give analytics consent.
The Privacy Policy describes the personal data involved, and the Legal Notice / Imprint identifies who is responsible.

2. Consent and how to change it
On your first visit a consent banner offers "Accept all" and "Essential only" with equal prominence, and "Customize" to see both categories. Analytics is off until you choose otherwise. Your choice is stored in an HTTP-only consent cookie and in browser storage. It is also recorded on our servers when you enable analytics or when an analytics session already exists for your browser; an "Essential only" choice made in a new browser is stored in that browser only.
You can change or withdraw your choice at any time with "Cookie preferences" at the foot of public pages, or in Settings, Privacy when you are signed in. Withdrawing analytics consent stops further analytics collection from that browser and removes our own analytics and attribution cookies listed below; the Google and PostHog cookies are no longer used and expire on their own. It does not switch off essential cookies, and it does not delete analytics records collected while consent was given; those expire on the schedule in the Privacy Policy.
Consent is stored per browser and device. Changing it on one device does not change it on another. When you enable analytics the page reloads once, so that the browser security policy that blocks analytics endpoints can be replaced with one that permits them.
Accepting the Terms of Service or confirming that you have read this policy never enables analytics. Analytics consent is a separate choice.
We do not respond to browser "Do Not Track" or Global Privacy Control signals, and we do not read or record them. Analytics stays off unless you enable it, whatever those signals say.

3. Cookies we set
The table lists production cookie names. Most carry the __Host- or __Secure- prefix for additional protection, and every cookie that the Service sets itself has the Secure flag and a SameSite restriction.
Cookie | Category | Purpose | Lifetime |
__Host-topotopic-session / topotopic-session | Essential | Signed-in session (HTTP-only). | Up to 60 minutes |
__Host-topotopic-refresh / topotopic-refresh | Essential | Session renewal token (HTTP-only). | Up to 7 days (30 days with remembered device) |
__Host-topotopic-browser-session-binding | Essential | Binds your session to this browser as a security check (HTTP-only). | Matches the renewal token |
__Host-topotopic-remember-device | Essential | Stores a remembered-device sign-in preference when you choose it (HTTP-only). | Up to 30 days |
__Host-topotopic-refresh-bridge | Essential | One-time marker that prevents sign-in redirect loops (HTTP-only). | 60 seconds |
__Host-topotopic-oauth-mfa | Essential | Carries a Google sign-in through the additional verification step when your account requires one (HTTP-only). | 5 minutes |
__Secure-topotopic-email-verification | Essential | Links your signup browser to the email verification step (HTTP-only). | Up to 48 hours |
__Secure-topotopic-email-verification-attempt | Essential | Carries a staged email-verification attempt through confirmation (HTTP-only). | 10 minutes |
__Secure-topotopic-verification-account | Essential | Remembers which account an email verification belongs to, so the page can show the address it was sent to in masked form (HTTP-only). | 10 minutes |
topotopic_oauth_link | Essential | Binds an attempt to link a Google account, or to connect Google Calendar, to the signed-in account (HTTP-only). | 10 minutes |
__Host-topotopic-google-callback-canary | Essential | Verifies that a durable Google sign-in callback completed (HTTP-only). | Up to 60 minutes |
__Secure-next-auth.state / __Secure-next-auth.pkce.code_verifier | Essential | Protects Google OAuth authorization and callback integrity (HTTP-only). | 15 minutes |
__Secure-next-auth.callback-url | Essential | Returns you to the requested TopoTopic page after Google sign-in. | Browser session |
__Host-next-auth.csrf-token | Essential | Protects authentication requests against cross-site request forgery (HTTP-only). | Browser session |
webauthn-auth-challenge / webauthn-auth-state (and registration variants) | Essential | Passkey sign-in and registration ceremony state (HTTP-only). | 5 minutes |
webauthn-recent-auth-challenge / webauthn-recent-auth-state | Essential | Passkey confirmation before a sensitive action such as requesting account deletion (HTTP-only). | 5 minutes |
admin_csrf | Essential | Protects operator administration actions against cross-site request forgery. Set only for operator accounts (HTTP-only). | Browser session |
__Host-tt-consent / tt-consent | Essential | Stores your cookie consent choices (HTTP-only). | 180 days when accepted, 30 days when declined |
__Host-tt-legal | Essential | Caches which versions of the Terms, Privacy Policy and Cookie Policy you accepted, for faster checks (HTTP-only). The server-side acceptance record remains authoritative. | Up to 365 days |
__Host-tt-legal-proof | Essential | Short-lived signed confirmation of a just-completed acceptance (HTTP-only). | 15 minutes |
tt_surface | Essential | Stores an internal interface selection marker (HTTP-only). | Up to 30 days |
topotopic_bot_guard | Essential | Marks browser sessions to help identify automated traffic (HTTP-only). | 15 minutes |
topotopic-session-id | Analytics | Random analytics session identifier that keys first-party usage measurement when analytics is enabled. | Up to 30 days |
__Host-tt-analytics-session | Analytics | Signed copy of the analytics session identifier (HTTP-only). | Up to 30 days |
__Host-tt-acquisition | Analytics | Signed record of how you arrived (campaign, referrer, landing page, advertisement click identifier, invitation) for consented measurement (HTTP-only). | Up to 30 days |
topotopic-acquisition | Analytics | Script-readable copy of how you arrived (campaign, referrer, landing page, advertisement click identifier, invitation). Written only after you enable analytics. | Up to 30 days |
topotopic-experiments | Analytics | Stores experiment assignment state. Written only after you enable analytics. | Up to 1 year |
consent-analytics-enabled | Analytics | Signals your analytics consent state to analytics scripts. | Matches the consent cookie |
_ga and _ga_* (Google Analytics) | Analytics (third party) | Google Analytics measurement identifiers. Set only after you enable analytics. | Up to 2 years (set by Google) |
_gcl_au and _gcl_aw (Google Ads measurement) | Analytics (third party) | Remembers the Google advertisement click that brought you here so we can measure which advertisements lead to sign-ups. Set only after you enable analytics. No advertising personalization. | Up to 90 days (set by Google) |
ph_* (PostHog) | Analytics (third party) | PostHog measurement identifier. The PostHog script runs on our pages, so the cookie is set on our domain, with a copy in browser storage. Set only after you enable analytics. | Up to 1 year (set by PostHog) |
Consent cookies set by earlier versions of the Service are not read as consent. They are removed the next time you save a choice.
Paid billing is not enabled. If it is enabled and you open a checkout or billing page, Stripe, the payment processor, sets its own cookies (for example __stripe_mid and __stripe_sid) to run the payment and prevent fraud. Google sets its own cookies on its sign-in pages when you choose Google sign-in.
A link to a YouTube video in a message is shown with YouTube's embedded player and thumbnail once the message is on screen. The player loads from youtube-nocookie.com and sets no cookies before you play the video. Google receives your IP address when the player or the thumbnail loads. Links to posts on X are shown as plain links.

4. Browser storage
Besides cookies, the Service uses browser storage (localStorage, sessionStorage and IndexedDB) on your device:
Consent record (essential): a copy of your cookie choice, so that the banner does not reappear on every page.
Sign-in support (essential): short-lived markers that coordinate sign-in, sign-out across tabs, and the legal acceptance check.
Settings you chose (essential): display settings, panel layouts, language and capture settings, dismissed hints, and per-conversation view state.
Recording and upload support (essential): a random identifier for this browser as a recording device, which lets an interrupted recording reconnect to the same session; per-tab recorder state and capture locks; and upload jobs that can resume after an interruption, with their file names, kept for up to 24 hours.
Offline data (essential): an offline copy of your learning feed, and learning actions waiting to be sent (IndexedDB).
Page recovery (essential): a timestamp that stops a page from reloading itself repeatedly after an error.
Analytics support (consent required): analytics identifiers, first-visit attribution, deduplication markers and the version of the analytics description you agreed to, written only while analytics is enabled.
The Service does not register a service worker and does not use the Cache Storage API.

5. Managing cookies in your browser
Most browsers let you remove or block cookies and clear site data. Blocking essential cookies prevents sign-in from working, and clearing site data shows you the consent banner again.
Questions about cookies and consent: support@topotopic.com.