1. What a cookie is here for
A cookie is a small file a site asks your browser to keep and send back on the next request. Because HTTP itself has no memory, a cookie is how the server knows the second request came from the same signed-in person as the first.
Everything we set is first-party — set by this site, readable by no other. All of it but one entry is exempt from needing your permission: four cookies are strictly necessary, in the sense that the Service does not work without them, and a fifth exists only to record the answer you gave the banner.
The exception is utricle_ref in section 2. Two things have to be true before it is written: you arrived on an invite link carrying a ?ref= code, and you pressed Accept on the consent banner. If you reject the banner, close it, or have not answered it yet, the code is not stored — the server checks for your recorded answer on every request and simply does not set the cookie without one. Nothing about the Service depends on it: arriving without a ?ref= link never sets it, and clearing this site's cookies removes it with no effect on anything except whether your inviter gets credited.
Your answer itself is kept in utricle_consent, which is how the server knows what you decided. It records nothing but the word accepted or rejected. To change your mind, clear this site's cookies — the banner will ask again, and any referral code already stored is cleared along with it.
2. The complete inventory
| Name | Purpose | Lifetime |
|---|---|---|
authjs.session-token__Secure-authjs.session-token | Your signed-in session. Holds a signed token identifying the account, nothing more. HttpOnly, so page scripts cannot read it. The __Secure- variant is the one used over HTTPS. | Until the session expires or you sign out |
authjs.csrf-token | Cross-site request forgery protection on sign-in and sign-out. Stops another site submitting those forms on your behalf. | Browser session |
authjs.callback-url | Remembers where to return you after sign-in, so a link into a deep page still lands you there. | Browser session |
qb.bsid | Browser sentinel. A non-persistent marker written at sign-in and checked on every protected request, so that a session token copied out of one browser does not work in another. This is the mechanism behind single-session enforcement. | Browser session — gone when you close the browser |
utricle_consent | Your answer to the consent banner — the single word accepted or rejected, and nothing else. It is what stops us setting the referral cookie below without your permission, and what stops the banner asking you again on every page. It is readable by this site's own scripts, because the banner has to check it in order to know whether to appear. | 6 months, or until you clear cookies |
utricle_ref | Referral capture, and the one cookie here that is not strictly necessary — so it is set only when utricle_consent above says you accepted. If you then arrive on a link carrying a ?ref= invite code, the code is stored so that whoever invited you is credited if you register later — often several visits after the click. It records their code and nothing about you; it is HttpOnly, so page scripts cannot read it; and it is never used for advertising, measurement, or profiling, nor shared with anyone. | 30 days |
Local storage
Two values are kept in your browser's local storage rather than in a cookie, which means they are never transmitted to us at all:
| Key | Purpose | Lifetime |
|---|---|---|
qbank-cookie-consent | A second copy of the same answer you gave the banner, kept from an earlier version of this site that stored it here only. The record that actually counts is the utricle_consent cookie above — a decision the server has to honour has to be one the server can see — so this key is now only a leftover we keep writing rather than orphan. It is never transmitted to us. | Until you clear site data |
theme | Your light / dark / system appearance choice. | Until you clear site data |
3. What we do not set
- No advertising or retargeting cookies.
- No social-network pixels — no Meta, X, LinkedIn, or TikTok tags.
- No third-party analytics: no Google Analytics, no session-replay tooling.
- No cross-site or cross-device identifiers.
- No fingerprinting in place of cookies.
This is a design choice and we intend to keep it. The referral cookie in section 2 is the only thing we set that is not strictly necessary, and it is attribution for an invitation you chose to follow — not advertising, and not a profile of you.
4. Third parties that see a request
A few services necessarily observe requests in order to serve them, but none of them sets a tracking cookie in your browser through us:
- Our hosting and CDN serve the pages and see the requests, as any host must.
- Cloudflare Turnstile, where enabled, runs a bot check on sign-up and sign-in. It is a privacy-preserving alternative to a CAPTCHA and does not build an advertising profile.
- Object storage serves question images from our own bucket domain.
5. Managing cookies
Every browser lets you view, block, and delete cookies for a site. Because everything we set apart from the referral cookie is either strictly necessary or the record of your own answer, blocking them has one predictable consequence: you will not be able to stay signed in — and, with nowhere to keep your answer, the banner will ask again every visit. The public marketing pages will work fine. Deleting utricle_ref on its own costs nothing except the credit to whoever invited you.
Clearing cookies is also how you withdraw consent: utricle_consent goes, so the banner asks again, and utricle_ref goes with it, so any invite code already stored is forgotten. Clearing site data additionally clears the two local-storage keys, which resets your theme to system.
6. Related
For the wider picture of what we collect and why, see the Privacy Policy. For how the session cookie is protected, see the Security policy.
7. Contact
If you find a cookie set by this site that is not listed above, that is a bug and we want to know: our contact form.