Cookie notice

Draft — this page is not finished. The legal name, address, contact and other operator details below are placeholders until they are filled in.

Last updated: [TODO effective date]

MoonCats sets one cookie. This page is short because there is not much to say.

The one cookie

One cookie, named better-auth.session_token (it appears as __Secure-better-auth.session_token over https). It is set by MoonCats itself, not by anyone else. It keeps you signed in for up to 7 days, and is replaced when you sign in again and removed when you sign out. It is httpOnly, so page scripts cannot read it, Secure, and SameSite=Lax. It is essential — without it you would be signed out on every page load — so it is not something you can opt out of while using an account.

What MoonCats does not set

No analytics cookies. No advertising or retargeting cookies. No pixels or beacons. If Cloudflare Turnstile is enabled in production — a bot check on the sign-up and password-reset-request forms — it is the one third party that can appear on this site; it runs in a Cloudflare-hosted frame and receives your IP address and browser signals in order to tell a person from a script. See the subprocessor table on the privacy page for its current status. It is a security measure, not tracking, and nothing on this site profiles you or follows you between sites — which is why there is no consent banner.

Local storage in the browser

None. The web app stores nothing in localStorage, sessionStorage or non-essential cookies.

The Android app

Not cookies, but stated here for completeness: the app keeps your session token in the device's secure storage (Android Keystore), and keeps a local copy of the day's checklist so it can show you something when you have no signal. Both live on your device.

Care-share links

Opening a care-share link sets no cookie at all; it needs no account and no session.

Questions

Contact [TODO operator contact email].