Two cookies, both first-party, both required to keep you signed in. No analytics, no advertising, nothing that follows you off this site.
You will have met a notice at the bottom of the screen on your first visit. It has one button, and that is deliberate rather than unfinished.
Consent is required for cookies that are not strictly necessary — analytics, advertising, personalisation, anything that profiles a visitor. This app sets none of those. Under the ePrivacy Directive and the UK PECR, cookies strictly necessary to deliver a service the user asked for are exempt, so there is nothing here to consent to.
Which leaves a Reject button two possibilities, and both are worse than not having one. It could do nothing — the pattern regulators actually pursue, because it manufactures the appearance of a choice. Or it could refuse the session cookie, which would sign you out of the site you are trying to use and call that a preference. So the notice says what is stored and what happens if you block it yourself, and then gets out of the way.
If you do block them — in your browser settings, or by refusing cookies from this domain — every page you can read without an account still works, including this one and everything linked from the footer. Signing in will not, because the session cookie is what a signed-in request is made of; there is no version of being logged in that does not involve one. Nothing is lost. You stay signed out.
The public pages — the one you are reading, and the twelve linked from the footer — set no cookies at all. You can read every one of them without the app storing anything in your browser.
HttpOnly, so page scripts cannot read them, and SameSite-restricted so they are not sent from other sites. Signing out clears them.localStorage, not a cookie, and never sent to the server — which is why the setting is per-browser rather than per-account. It holds one of three words: light, dark, or nothing at all when you are following your system.There is a third thing in browser storage worth naming, though it is not a cookie and it is not tracking: if you register a browser so that unlocking your encrypted messages does not need the passphrase every time, that browser holds key material locally. It never leaves the machine, and you can revoke that browser from the app. Security explains the mechanism.
Clearing site data signs you out, resets your theme to follow your system, and brings the notice back on your next visit — its dismissal is remembered in localStorage rather than in a cookie, because a cookie banner that stores its own answer in a cookie is a joke that writes itself.
One thing worth knowing first: if you had registered this browser so that unlocking your encrypted messages did not need the passphrase every time, that key material goes with it. You will need your recovery passphrase again, and nobody can reissue it. See security.
If this app ever sets a cookie that is not strictly necessary, this page changes first and a consent mechanism ships with it. See the privacy policy for what is collected beyond the browser, and the data processing page for where it is held.