Cookies Policy

1. What Are Cookies

Cookies are small text files that are stored on your device when you visit a website. They help provide you with a better experience by remembering your preferences and enabling certain functionality.

2. How We Use Cookies

Twistloom uses cookies for the following purposes:

3. Types of Cookies We Use

3.1 Essential Cookies (httpOnly)

These cookies are necessary for the Service to function properly. We use NextAuth v5 (Auth.js) with httpOnly cookies for authentication, which provide enhanced security:

• NextAuth Session Token: JWT-based session token for authentication (next-auth.session-token / __Secure-next-auth.session-token)
• Guest Identification: Identifies guest users before account creation
• CSRF Protection: Prevents cross-site request forgery attacks

Security Features:

• NextAuth v5: Version 5.0.0-beta.31 with JWT session strategy
• httpOnly flag: Prevents JavaScript access (XSS protection)
• Secure flag: Ensures transmission over HTTPS only in production
• SameSite: none: Required for cross-origin architecture (frontend/backend on different domains)
• We do NOT use localStorage or sessionStorage for authentication data

3.2 Functional Cookies

These cookies enable enhanced functionality and personalization:

• Language Preference: Stores your preferred language (English, Indonesian) via next-intl
• Theme Preference: Remembers your theme preference (dark/light mode) via @wrksz/themes
• Reading Progress: Save your position in stories
• Bookmarks: Store your bookmarked pages and choices
• Preferences: Remember your display settings and preferences

Cookie Usage:

• next-intl: Language preference stored in cookies for server-side rendering
• @wrksz/themes: Theme preference stored in cookies for consistent experience
• We use cookies to store non-sensitive preferences like language and theme
• Language preference enables server-side rendering to respect your language choice
• Cookies persist across browser sessions and are specific to your device
• Cookies are never used for authentication or sensitive data
• You can clear cookies by clearing your browser data or using incognito mode

3.3 Analytics Cookies

These cookies help us understand how users interact with the Service:

• Usage Analytics: Track page views and user journeys
• Performance Monitoring: Monitor site performance and errors
• A/B Testing: Test new features and improvements

3.4 Third-Party Cookies

We may use third-party services that set their own cookies:

• Google OAuth (via NextAuth v5): Sets cookies for social login functionality
• Vercel Analytics 2.0.1: Performance and usage analytics cookies
• AI Providers: Cookies for AI service integration (GitHub Models, Google Gemini, Mistral AI, Cohere, Groq, Cerebras, NVIDIA)

4. Cookie Duration

• Session Cookies: Deleted when you close your browser
• Persistent Cookies: Remain on your device for a set period (typically 30 days to 1 year)
• NextAuth Session Cookies: JWT-based with configurable expiration
• Guest Cookies: Expire after 30 days of inactivity
• Language Preference: Persists until manually changed or cleared
• Theme Preference: Persists until manually changed or cleared

5. Managing Cookies

You can control and manage cookies in various ways:

5.1 Browser Settings

Most web browsers allow you to:

• View what cookies are stored and delete them
• Block all cookies or only third-party cookies
• Delete cookies when you close your browser
• Block cookies from specific websites

Please note that blocking essential cookies may prevent the Service from functioning properly.

5.2 Cookie Preferences

We provide a cookie consent banner where you can:

• Accept all cookies
• Reject non-essential cookies
• Manage specific cookie categories

6. Cross-Origin Cookies

Twistloom uses a cross-origin architecture where the frontend and backend are on different domains. Our cookie configuration includes:

• SameSite: none: Allows cookies to work across domains
• Secure: true: Ensures cookies are only sent over HTTPS
• httpOnly flag: Prevents JavaScript access for security

7. Guest User Cookies

For users who haven't created an account, we use cookies to:

• Identify your session across page loads
• Associate story progress with your guest session
• Migrate data to your account when you sign up

Guest cookies are removed when you:

• Create an account (data is migrated)
• Clear your browser cookies
• After 30 days of inactivity

8. Security and Privacy

We prioritize security in our cookie implementation:

• All authentication cookies use the httpOnly flag (JavaScript cannot access them)
• Cookies are only transmitted over HTTPS connections
• We never store sensitive data in non-httpOnly cookies
• We do not use localStorage or sessionStorage for authentication
• Cookies have appropriate expiration times
• We regularly review and update our cookie security practices

9. Updates to This Policy

We may update this Cookies Policy from time to time to reflect changes in our cookie practices or for legal and regulatory reasons. We will notify you of any material changes by updating the "Last updated" date on this page.

10. Contact Information

If you have any questions about our use of cookies, please contact us at flias.test@gmail.com or through our support channels.