Last Seen Up
Cookie policy
Effective 4 August 2026
Most cookie policies are long because most sites have a lot to declare. This one is short for the opposite reason.
Five cookies, all first-party, none of them tracking anything. Below is the complete list, what each one does, and how long it lasts.
1The short version
We set five cookies. Three keep you signed in, one remembers whether you chose light or dark, and one remembers whether your sidebar was open. That is the entire list, and it is written out in full below.
There is no Google Analytics, no advertising pixel, no social widget, no session recorder, no A/B testing tool and no third-party script of any kind. No cookie set by this site is readable by anyone else, because there is no one else.
2Strictly necessary cookies
These make signing in work. They cannot be turned off, because turning them off means not being able to sign in — which is the thing you came here to do. They carry no consent requirement under UK and EU law for exactly that reason.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Cookielast-seen-up-session | PurposeIdentifies your browser session so you stay signed in as you move between pages. Encrypted, and readable only by the server. | Lifetime2 hours of inactivity |
| CookieXSRF-TOKEN | PurposeProves a form was submitted from this site rather than by another site acting as you. Standard cross-site request forgery protection. | Lifetime2 hours of inactivity |
| Cookieremember_web_* | PurposeOnly set if you tick “remember me” when signing in. Keeps you signed in after the session cookie expires. | Lifetime5 years, or until you sign out |
3Preference cookies
These remember two choices you made about how the interface looks. You can turn them off, and turning them off genuinely stops them being written — this is not a switch that only changes what a banner says.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Cookieappearance | PurposeWhether you chose light, dark or system. Read on the server before the page renders, which is what stops a dark-mode user getting a white flash on every load. | Lifetime1 year |
| Cookiesidebar_state | PurposeWhether the dashboard sidebar was expanded or collapsed. | Lifetime7 days |
| Cookiegetting_started_dismissed | PurposeThat you closed the setup checklist on the dashboard and do not want it back. Read on the server, so the card does not flash up before the page can hide it. | Lifetime1 year |
What you lose by refusing them. All three still work while the tab is open. They are simply forgotten afterwards, so the theme falls back to whatever your operating system is set to, the sidebar returns to its default, and the setup checklist reappears on your next visit. Nothing else changes.
4Local storage
Two values are kept in your browser’s local storage rather than in a cookie. They are never sent to the server:
appearance— the same light/dark choice as above, held client-side so the theme applies instantly before any network request. Removed if you decline preference cookies.cookie-consent— your answer to the cookie banner and when you gave it. Recording a refusal of cookies by setting a cookie would be a poor joke, so this one lives in local storage.
5Changing your mind
Your choice is not permanent and does not need to be justified. There are three ways to change it:
- Use the cookie settings link in the footer of any public page, or the button below.
- Clear this site’s cookies and local storage in your browser, which resets everything and brings the banner back.
- Block cookies for this site entirely in your browser settings. Sign-in will stop working, and that is not something we can work around.
6The API, the app and heartbeats
Cookies are a browser concern, and two of the three ways into Last Seen Up are not browsers:
- The iOS app authenticates with a bearer token held in the device keychain. It sets no cookies and uses no web view for anything that matters.
- The API at
/api/v1runs with no session and no CSRF layer at all. A request with a bearer token gets no cookies back. - Heartbeat ingest at
/hb/…is called by cron jobs. It passes through no session middleware, sets nothing, and answers 200 to everything.
7Changes and contact
If this list grows
If we ever add a cookie in a new category — analytics being the realistic case — it will be listed here before it is set, it will be off until you agree to it, and everyone’s existing choice will be discarded so the question gets asked again. An old “accept” given to a two-category site is not consent to a third category.
Questions
Email [email protected]. The wider picture is in the privacy policy.