Cookie Policy
Last updated: May 2026
Summary
HostStack uses the minimum cookies needed to keep you logged in and remember your preferences. We do not use third-party advertising cookies, fingerprinting, or behavioural tracking. We do not load Google Analytics on the dashboard.
Strictly necessary cookies
These are required for the site to function and cannot be disabled. They are set on first use of the corresponding flow (login, banner dismissal, OAuth redirect) and cleared automatically when no longer needed.
| Name | Purpose | Lifetime |
|---|---|---|
| session | Authentication. Holds your session token after you log in. HttpOnly + Secure + SameSite=Lax. | 30 days |
| hs-cookie-consent | Remembers that you have dismissed the cookie banner so the banner is not re-rendered on every page load. SameSite=Lax. | 1 year |
| github_pending | Set briefly during the GitHub OAuth login redirect to carry pending sign-in state across the round-trip. HttpOnly + Secure + SameSite=Lax. | 10 minutes |
| oauth_login_2fa_pending oauth_link_2fa_pending | Set only when a 2FA-enabled account completes an OAuth sign-in/link and is redirected back to enter the second factor. Carries the short-lived temporary token to the 2FA prompt page. HttpOnly + Secure + SameSite=Lax. | 5 minutes |
Preference cookies
We store a small amount of preference data in localStorage (not strictly a cookie, but worth disclosing): your colour theme (light/dark) and your last selected team. This data never leaves your browser.
Third-party cookies
When you go through Stripe checkout to upgrade a plan, Stripe sets its own cookies on checkout.stripe.com for fraud prevention and session handling. These are governed by Stripe's cookie policy. We do not set any third-party cookies on the HostStack site itself.
Controlling cookies
You can clear cookies through your browser settings at any time. Clearing the session cookie will log you out. Disabling cookies entirely will prevent you from logging in.
Changes to this policy
If we add new cookies or change how existing ones are used, we'll update this page and bump the "Last updated" date above. For material changes that affect privacy, we'll also notify logged-in users in-app.
Operator
HostStack is operated by MICCI — CVR: 45587452 — Fyrretoften 31, 7100 Vejle, Denmark.