Cookies
Last updated: 31 October 2026
signups_SA6thward sets only the cookies it needs to operate. It sets no analytics, advertising, or cross-site tracking cookies. If the operator has enabled third-party sign-in (for example, Google) and you use it, that provider may set cookies on its own domain when you sign in there; those are governed by the provider's policies, not ours.
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| authjs.session-token (or __Secure-authjs.session-token over HTTPS) | Keeps organizers signed in after they sign in. | 30 days from when you sign in |
| authjs.csrf-token (__Host-authjs.csrf-token over HTTPS) | Prevents cross-site request forgery on the sign-in form. | Short-lived |
| authjs.callback-url (__Secure-authjs.callback-url over HTTPS) | Remembers where to return you after a successful magic-link sign-in. | Short-lived |
| authjs.pkce.code_verifier (__Secure-authjs.pkce.code_verifier over HTTPS) | Checks that a Google sign-in finishing here is the one this browser started. Set only if this site has Google sign-in turned on and you use it. | 15 minutes |
| os_commit | Keeps the private link to change or cancel each slot a participant signed up for, so they can come back from the same browser without finding the link again, whether or not they gave an email. httpOnly; not readable from JavaScript. | 60 days, or until a week after the latest slot it holds if that is later (at most 400 days) |
| os_oauth_session | Records which organizer is signed in while connecting an app or AI assistant to their account. Sent only to the connection endpoints under /api/oauth. | 24 hours |
| os_oauth_interaction | Ties a pending connection request to the browser that started it, so only that browser can approve it. | 15 minutes |
| os_oauth_resume | Carries your allow-or-decline answer back to finish (or cancel) the connection. | 15 minutes |
The three os_oauth_* cookies are set only when an organizer connects an app or AI assistant to their account, and each one is paired with a .sig cookie of the same name and lifetime holding the signature that proves we set it. All of them are httpOnly, limited to the page or endpoint that needs them, and marked Secure over HTTPS. See the privacy policy for what a connected app can reach and how to disconnect it.
Other storage in your browser
After you sign up for a slot, the sign-up form saves the name and email address you entered in your browser's local storage, under the key opensignup:lastCommit, and uses it to fill in the form the next time you sign up for anything on signups_SA6thward. It is not a cookie and is not sent to us on its own; we only see it when you send the form again. It has no expiry: it stays until you clear this site's data in your browser, and each sign-up updates it. On a shared or public computer, the next person to sign up for anything on signups_SA6thward in the same browser will see your name and email address filled in, so clear this site's data when you have finished.
Why there is no cookie banner
Every cookie above is strictly necessary to make the service work — for sign-in, to let a participant edit their own commitment, or to complete a connection an organizer asked for. Under GDPR/ePrivacy, strictly-necessary cookies do not require a consent banner. That is why you don't see a popup.
Related
See the privacy policy for what data we store and how to request a copy or deletion.