Last updated October 13, 2026
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| __Host-gitfor_session | Keeps you signed in. HttpOnly, Secure, SameSite=Lax. | 30 days (ends after 14 days without use, or when you sign out) |
| __Host-gitfor_2fa | Remembers that you passed the password step while you enter a two-factor code. | 5 minutes |
| __Host-gitfor_oauth | Protects GitHub sign-in against cross-site request forgery. | 10 minutes |
| __Host-gitfor_integration_oauth | Protects connecting an integration against cross-site request forgery. | 10 minutes |
| __Host-gitfor_site, __Host-gitfor_state | Set only on access-restricted Sites hosts, to let signed-in viewers in. | While the site session lasts |
On a plain-HTTP development host the same cookies are set without the __Host- prefix.
Local storage
The browser also stores a few preferences locally, never sent to us: whether you opted out of analytics, and which notices you dismissed. Clearing site data resets them.
Analytics
If the operator enables PostHog analytics and session recording, PostHog stores a random visitor and session id in a first-party cookie (ph_<project>_posthog, up to 1 year) and in your browser's local storage on this host only, so visits and recordings can be grouped. It is never shared with other sites and is not used for advertising. Nothing is set or sent when your browser sends Do Not Track or Global Privacy Control, and you can opt out in Settings, which stores one local setting so the choice sticks. See the Privacy Policy for details.
Third parties
Cloudflare Turnstile runs a bot check on signup and sign-in; it is a security measure and does not set tracking cookies. Stripe Checkout runs on Stripe's own domain under Stripe's cookie policy.