Cookie Policy
The few cookies the app sets, what each is for, and how long it lasts.
Last updated 25 October 2026
1. What we use
Exbrush sets only the cookies it needs to sign you in and remember how you left the app. There are no advertising cookies and no third-party analytics.
| Name | Purpose | Lasts |
|---|---|---|
| better-auth.session_token | Keeps you signed in. | 30 days |
| better-auth.session_data | A signed copy of your session, so pages load without a lookup. | 5 minutes |
| better-auth sign-in state | Carries a sign-in through Google or GitHub and back, so it cannot be forged. | A few minutes |
| sidebar_state | Remembers whether the studio sidebar is open or collapsed. | 7 days |
| exbrush:verify-email-dismissed | Remembers that you closed the verify-email banner. Session storage, not a cookie. | Until the tab closes |
On the live site the sign-in cookies carry a __Secure- prefix, which means they are only ever sent over an encrypted connection.
3. Your control
You can block or delete cookies in your browser’s settings. Without the sign-in cookies you cannot stay signed in; without the sidebar cookie the app simply forgets its layout.
4. More
How we handle personal data in general is in the Privacy Policy. Questions go to support@exbrush.com.