Cookie Policy

Last updated: October 19, 2026

1. What counts as a cookie here

Cookies, localStorage entries and similar browser storage that this site sets. We keep the list short — that is the point of a minimal, cookie-light service.

2. Strictly necessary browser storage

fs_session (localStorage) — your session token after GitHub OAuth. Stored on your device only, sent as a Bearer header with API calls. Deleting it (or tapping "Sign out") ends your session; the token itself expires after 30 days.
fs_user (localStorage) — cached copy of your profile (username, avatar, plan) so the app renders without re-fetching.
mc_projects_v3 (localStorage) — offline cache of your project list for faster loading.
fs_deleted_projects (localStorage) — which projects you hid from your own dashboard.
fs_theme (localStorage) — dark/light theme preference.
OAuth state — CSRF protection during the GitHub login flow is stored server-side in our database, never in your browser.

We set no HTTP cookies for authentication — sign-in state lives in localStorage on your device, not in cookies we can read.

3. Analytics (opt-in only)

Google Analytics 4 sets cookies (_ga, _ga_*) only after you click "OK, measure" on the cookie banner. The tag runs with IP anonymization and Google Consent Mode. If you decline or ignore the banner, GA4 is never activated and no analytics cookies are set. Before consent, only your choice is remembered:

fs_cookie_consent (localStorage) — remembers whether you accepted or declined analytics, so the banner does not nag you on every visit. No personal data.

4. What we never set

No advertising cookies, no retargeting pixels, no cross-site trackers.

5. Managing storage

You can clear site data for frankenstack.app anytime in your browser settings — the app keeps working, you just sign in again. Questions: open an issue at https://github.com/richter80/frankenstack/issues.