Cookie notice

1. Signing you in

Auth.js, the library that runs sign-in, sets a small number of cookies to make that work. All of them are strictly necessary — none are for advertising or tracking — and each is verified against a real sign-in, not assumed from documentation:

• —authjs.csrf-token — protects the sign-in form from cross-site forgery; set the moment you open it.
• —authjs.callback-url — remembers which page to send you back to once you're signed in.
• —authjs.session-token — keeps you signed in between visits; set once you actually sign in.
• —authjs.pkce.code_verifier — set only if you choose "Continue with Google", and cleared again a few minutes later once that sign-in finishes.

2. Remembering your theme

Your light/dark theme choice is remembered in your browser's own local storage, not a cookie, and never leaves your device.

3. Analytics — only if you agree

We use PostHog, hosted in the EU (Frankfurt), to see which pages are used and where people get stuck. If you accept, PostHog stores a cookie named ph_<project key>_posthog and an entry of the same name in your browser's local storage, plus, for the current tab only, a few session-storage entries whose names start with ph_<project key>_; it may also record your visit, with everything you type, and the parts of the page that show your account and address, hidden. If you haven't answered yet, nothing is stored on your device; if you decline, only a note of that answer is (clause 4). Either way nothing is recorded, and visits are counted anonymously, without cookies, using a hash of your IP address and browser that changes every day. Errors in your browser are reported the same way until you accept; errors on our side are covered by the Privacy policy. You can change your choice at any time with "Cookie settings" at the bottom of every page.

4. Remembering your choice

Your answer, accept or decline, is kept in a small local-storage entry named __ph_opt_in_out_<project key>, so we don't ask again on every visit.

5. Invitation links

If you open a friend’s invitation link (boxcrossing.com/r/ followed by a short code), we set one strictly necessary cookie so the invitation survives until you sign up. It is not used for advertising or tracking:

• —bx_invite — holds the friend’s invitation code and the time you opened the link; kept for 30 days, and removed the first time you sign in. Set only if you don’t already have one from a link that still works; one from a link that no longer works is replaced.
• —bx_invite_hidden — a note in your browser’s session storage (not a cookie) that you hid the invitation reminder strip; it disappears when you close the tab.

6. Nothing else

We don't run advertising or any other third-party tracking scripts.