Cookies

Short version

StageTile uses first-party cookies for sign-in, sign-in security and your chosen dashboard appearance. No tracking cookies and no advertising cookies. Your appearance choice is stored only for the browser session.

Cookies StageTile sets

• __Host-stage_session: Your sign-in session. Seven days since your last authenticated activity, renewed with activity in both the browser and server record. At most five active devices; a new sign-in retires the least recently active device when needed. Activity does not refresh the age of your OAuth ceremony for account deletion. HttpOnly, Secure, SameSite=Lax, Path=/, with no Domain attribute. Cleared when you log out or delete your account.
• __Host-stage_login: Binds a sign-in or account-deletion reauthentication attempt to your browser. Five-minute maximum age. HttpOnly, Secure, SameSite=Lax, Path=/, with no Domain attribute. It remains until expiry so independently started sign-in tabs can finish; logout clears it. Old Spring session and CSRF cookies and earlier candidate auth cookies are retired, without importing Spring sessions. Explicit loopback tests use stage_session and stage_login without Secure.
• stage-theme: Stores the light or dark dashboard appearance you choose for this browser session. It is set only when you change appearance, and is cleared when you log out. Browser session restoration may retain session cookies. Remove stage-theme through your browser's cookie controls and reload to use your public tile's appearance as the default.

These cookies are first-party, scoped to this host and Path=/, with SameSite=Lax. They are Secure in production and are not shared with third parties. The dashboard uses a server-validated CSRF token for authenticated changes; it does not set a separate CSRF cookie or an owner-page-address cookie.

No tracking, no analytics cookies

StageTile counts aggregate origin document requests on the server. No cookies are set for analytics. No user profiles. No cross-session tracking. No Umami. StageTile does not load third-party advertising scripts or tracking pixels.

Your controls

Changing Dashboard appearance is optional and sets stage-theme for this browser session. Without it, a freshly loaded dashboard uses your public tile's theme. You can remove the preference in your browser and reload. Blocking the sign-in cookies prevents authentication. Google and GitHub may set their own cookies when you visit them to sign in; their policies apply to those visits.

This page describes what the service stores. It does not claim one universal cookie-consent exemption for every jurisdiction. New storage purposes require a fresh assessment and an updated disclosure before use.

Questions

Contact privacy@stagetile.com.