Cookie Policy

Last updated: September 26, 2026

This policy describes cookies and similar storage BEVEL uses. It supplements the Privacy Policy.

What we set

• Session. Auth.js session and callback cookies so we know you are signed in. Secure, HTTP-only, host-scoped on HTTPS hosts including .lvh.me and production.
• CSRF. A token cookie paired with the sign-in form so a third-party site cannot POST a Google or Microsoft sign-in as you.
• Last used method. A value in localStorage (bevel.lastSignIn) so the login card can badge the provider you used last. It never leaves your device.
• Preferences. Device-local UI settings (day part, density) stored in the browser.
• Native handoff. Short-lived cookies that finish sign-in from the desktop or mobile app back into the browser, then expire.

What we do not set

We do not set advertising cookies. We do not drop third-party marketing pixels on the signed-out login card. If we add non-essential analytics cookies later, this page will list them and we will ask before they run in regions that require consent.

Duration

Session cookies last up to 30 days or until you sign out. CSRF cookies are short-lived around a sign-in attempt. Last-used is stored until you clear site data.

Your controls

You can block or delete cookies in your browser. Blocking session or CSRF cookies will prevent sign-in. Clearing site data removes last-used and local preferences. Questions: hello@bevel.is.