Trang này chưa có bằng ngôn ngữ của bạn. Bạn đang đọc bản tiếng Anh.
Legal
What this site puts in your browser
The whole list, five entries
One cookie, three keys in local storage and one key that lives no longer than the tab. That is everything.
Each is named below by the name you will see in the developer tools of your own browser, so the list can be compared rather than believed.
NEXT_LOCALE, a cookie
Holds a language code and nothing else. Written only when you pick a language from the menu, and kept for a year.
armanos-theme, local storage
Holds the word dark or the word light. Written only when you press the theme button.
armanos_access_token, local storage
The short lived key that proves you are signed in. Written on sign-in, removed on sign-out.
armanos_refresh_token, local storage
The key that asks the server for a fresh access key. Written on sign-in, removed on sign-out.
armanos.fromApp, session storage
Holds the digit one if you arrived here from the desktop app. It disappears when the tab closes.
Your sign-in keys and the risk in them
Both sign-in keys sit in local storage, which any script running on this page is able to read. A cookie marked http-only would be out of reach of scripts; these two are not, and that is a real difference rather than a detail.
What stands between them and a foreign script is that no foreign script runs here. The response rule named below allows scripts only from our own address, so the browser refuses a foreign one even if one ever appeared.
Signing out removes both
Nothing is written before you act
A visit that only reads pages leaves nothing behind. Every one of the five is written by something you did: picking a language, pressing the theme button, signing in, or arriving from the app.
Nothing is written on page load and nothing in the background. There is no service worker keeping a copy of the site, and no database in the browser holding anything of yours.
The theme key and the tab key
The theme key holds one of two words. A small script built into the page reads it before the page paints, which is why a dark page does not flash white on the way in.
The tab key is set only for people who came here from the desktop app. It is used once, to offer opening the app already signed in, and the browser drops it with the tab.
No counters, and no foreign scripts
There is no analytics on this site. No tag manager, no session recorder, no crash reporter, no advertising pixel and no social button phoning home.
That is a count rather than a claim. Every built page was walked for the things a browser fetches on its own: scripts, stylesheets, images, frames and preconnect hints. The number pointing at any host other than ours is zero.
The two typefaces are fetched once at build time and served from our own address, so reading this sends nothing to a font service. The response also switches off the browser interest cohort here, so the visit feeds no advertising group.
How to check this page yourself
Open the developer tools, go to the storage panel, and look at cookies and local storage for this address. What you find should be the list above and nothing beside it.
The network panel answers the other half. Reload the page with it open and every row should carry our own address.
What this page does not cover
- It does not describe what a site opened through a profile puts into that profile. That happens in a different browser on your own disk, and nothing here reaches it.
- It does not say how long anything is kept on our server. That belongs to the terms of sale, and those are not written yet.
- It does not cover where a download button sends you. The installer files are hosted at an address chosen when the site is built, and that is a link you press rather than a request the page makes.
- It is not legal advice and does not claim compliance with any regime by name.
Where this is decided
Each line is a file you can open.
- The language cookie, where it is written and where it is read
- apps/web/components/site/LanguageSwitcher.tsx · apps/web/middleware.ts
- The two sign-in keys, written on sign-in and removed on sign-out
- apps/web/lib/auth.ts
- The theme key and the script that reads it before the page paints
- apps/web/components/site/ThemeToggle.tsx · apps/web/app/not-found.tsx
- The tab key, set on arrival from the app and used once
- apps/web/components/auth/AuthForm.tsx · apps/web/components/dashboard/OpenInAppBanner.tsx
- The rule that allows scripts and styles only from our own address
- apps/web/next.config.js
- An issued API key is never put into browser storage, checked by running
- apps/web/test/api-keys-web.js
Questions
- Why is there no cookie banner?
- There is one cookie, it holds a language code, and it is written only when you pick a language yourself. Nothing on this site counts you, follows you between sites or hands anything to a third party.
- Can I browse the site with storage blocked?
- Reading works. Every write is wrapped so a refusal is ignored rather than thrown at you; the language then follows your browser and the theme follows your system. Signing in will not hold, because the key has nowhere to live.
- Is my sign-in kept in a cookie?
- No. The two keys live in local storage and travel to our server in a request header. No cookie of ours is ever sent to the server at all.
- What happens to all five when I sign out?
- Both sign-in keys are removed at once. The language cookie and the theme key stay, because neither has anything to do with your account.
- How was the number of foreign requests reached?
- By walking every built page and reading every attribute a browser fetches from, rather than by looking at a few. The result is zero, and the response rule below is what keeps it zero.
Nearby
Legal
The rest of this section and what is still missing from it.
What the server holds about you
The other half of the question: what leaves your machine and what never does.
Security
The same facts from the safety side rather than the legal one.
Tracker blocking
What the app cancels for the sites you open through a profile.
Found something we did not list?
Open your developer tools, compare, and write to us with what you saw. A page like this is worth only as much as its shortest list.