Cookies
Why there is no consent banner
Because we only set cookies that are strictly necessary to provide the service you asked for, and those require no consent under the Swedish Electronic Communications Act. A banner would be theatre.
Every cookie we set
| Name | Purpose | Lifetime |
|---|---|---|
| Session | Keeps you signed in. Signed, HttpOnly, SameSite=Lax. | 12 hours idle, 30 days absolute |
| CSRF token | Stops a third-party site submitting a form as you. | The session |
| Sign-in in progress | Holds the state and nonce while you are away at the identity provider. Deleted when you come back. | 10 minutes |
Other storage in your browser
Local storage holds your theme choice, your basket before you sign in, and the calorie diary. None of it is transmitted to us, and clearing your browser data removes all of it. Local storage is not a cookie, but it is storage on your device, and listing it here is the honest reading of the rule rather than the narrow one.
What we do not set
No analytics cookie, no advertising cookie, no third-party pixel, no social embed that phones home. The full English privacy notice is at /en/privacy.