Cookie Notice

• Version: 0.1 (draft)
• Date: 2026-10-14

Summary

hyad sets only strictly necessary cookies: to sign you in, keep you signed in, and protect sign-in against forgery. The sign-up and password reset pages also run Cloudflare Turnstile, a bot check (see below). There are no analytics, advertising or tracking cookies, and no third-party cookies on hyad's own pages other than what Turnstile may use. Strictly necessary cookies need no consent under the ePrivacy rules ([[CHECK: Dutch Telecommunications Act Art. 11.7a(3)(b)]]), so hyad shows no cookie banner.

[[CHECK before relying on "no banner": (1) that no Cloudflare dashboard setting adds cookies such as __cf_bm (Bot Fight Mode is not managed in Terraform); (2) the Turnstile entry below; (3) the localStorage item below.]]

The cookies

All of them are first-party, Secure, HttpOnly (not readable by page scripts) and host-only (__Host- prefix: valid only on the exact address that set it).

Name	Set on	Purpose	Lifetime
__Host-hyad.session_token	auth.hyad.app	Your hyad sign-in session	30 days, renewed daily while used
__Host-hyad.state and other short __Host-hyad.* cookies	auth.hyad.app	Protects sign-in with Google or GitHub and passkey sign-in against forgery	Minutes, deleted after use
__Host-hyad_portal	platform.hyad.app	Your session on the hyad portal	Until your sign-in session ends (at most 30 days)
__Host-hyad_portal_state	platform.hyad.app	Protects the sign-in round trip	10 minutes
__Host-hyad_passkey	platform.hyad.app	One passkey sign-in or registration in progress	5 minutes
__Host-hyad_site_choice	platform.hyad.app	Carries the mode you picked on the public site (developer, explain, do) through sign-up	1 day, deleted after sign-in
__Host-hyad_ask_later	platform.hyad.app	Remembers "ask me later" on the welcome page	Until you close the browser
__Host-hyad_session	each app's address (<name>.hyad.app or its custom domain)	Your sign-in to that app	Ends after 12 hours without use, and when your hyad session ends
__Host-hyad_state	each app's address	Protects the sign-in round trip to that app	30 minutes

Browser storage. The public site (hyad.app) stores the mode you pick (hyad.for: developer, explain or do) in your browser's local storage so the next page uses it. It never leaves your browser. [[CHECK: a preference the visitor sets explicitly is normally treated as necessary for the requested service; confirm, or switch it to session storage]]

Cloudflare Turnstile (bot protection)

Where	The sign-up and password reset pages on platform.hyad.app
Provider	Cloudflare, Inc. (see the Privacy Policy, section 4)
What it does	Checks that a real person, not a bot, is signing up or resetting a password. To do so it reads signals from your browser and device (for example browser features and how the page was used) and may store data on your device
Legal basis	Strictly necessary for the security of the service you asked for: no consent needed ([[CHECK: Dutch Telecommunications Act Art. 11.7a(3)(b)]]). The personal data involved is covered by the Privacy Policy (legitimate interest in preventing abuse)
Lifetime	[[CHECK: what Turnstile actually stores on our pages (cookies, local or session storage) and for how long]]

Cookies of others

• Stripe Checkout runs on Stripe's own pages (checkout.stripe.com), which set Stripe's cookies, covered by Stripe's cookie policy.
• Sign in with Google or GitHub happens on those services' pages, under their policies.
• Apps hosted on hyad can set their own cookies and use their own analytics. The app's owner is responsible for those and for asking consent where needed. hyad's cookies above are the only ones the platform itself sets on app addresses.

Controlling cookies

You can delete or block cookies in your browser. If you block the cookies above, you cannot sign in. Questions: support@hyad.app.