The small print
Cookies.
Last updated 7 September 2026
This site sets four cookies, all of them strictly necessary, and all of them tied to signing in with X. There are no analytics cookies, no advertising cookies and no third party cookies, which is why there is no consent banner in your way.
The full list
| Cookie | What it does | Lasts |
|---|---|---|
| x_oauth_state | A random value that proves the sign in coming back from X is the one you started. Without it, someone could hand you a forged callback. | 10 minutes |
| x_oauth_verifier | The PKCE secret that proves this browser began the sign in, so an intercepted code is useless on its own. | 10 minutes |
| x_oauth_return | The page you were on, so signing in brings you back to it instead of the front page. | 10 minutes |
| x_handle | Your X handle after a successful sign in. It is how the forge knows who you are without asking again. | 7 days |
All four are set with HttpOnly, so scripts on the page cannot read them, and SameSite=Lax, so they are not sent along with requests started by other sites. In production they are also Secure, meaning they only travel over HTTPS.
The first three are deleted the moment sign in finishes, whether it worked or not.
Why there is no banner
Consent banners exist for cookies that track you. These four do one job: keep you signed in and keep the sign in itself safe. Nothing here follows you to another site, builds a profile, or measures your behaviour, so there is nothing to ask you to opt into.
Turning them off
You can block or clear them in your browser settings at any time. Clearing x_handle signs you out. Blocking cookies for this site entirely means sign in cannot work, and any Quest spot you claim will be recorded as unverified.
Not cookies, but worth knowing
Your drawing and your progress are kept in your browser's local storage rather than in a cookie, so they are never sent to us with every request. The privacy page lists exactly what is in there.