Cookie and analytics position - review draft

The signed HTTP-only session cookie supports authentication. A separate same-site CSRF cookie supports browser mutation protection. Theme preference is held in local storage. Exact expiry and security behavior are documented in the repository cookie position.

Advertising, cross-site profiling, session replay, and product analytics are disabled by default. No such tool may be enabled until its events, data fields, masking, provider, region, retention, notice, consent/legal basis, and opt-out behavior are reviewed.

Before publication, inventory hosting/CDN logs, security tools, support widgets, browser monitoring, and customer-added scripts. The final notice and controls must reflect the deployed behavior and applicable national rules.