Legal
Cookie Policy
StreamBoost sets three first-party cookies. There are no advertising cookies, no third-party cookies and no tracking pixels.
Last updated
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
session | Keeps you signed in.Holds an opaque token that points at a session record on the server. It does not contain your email, your identity or your password. Signing out deletes the server-side session, so the token stops working immediately. | Strictly necessary | Until it expires or you sign out |
sb_ctx | Anti-abuse context for sign-up and sign-in.Ties the browser challenge that protects account creation to the request that completes it. Without it, sign-up cannot distinguish a real browser from an automated script. | Strictly necessary | Short-lived |
locale | Remembers your language.Stores a short language code such as “en” or “de” so the site renders in the language you picked. Nothing else is stored in it. | Preference | Up to one year |
Why there is no cookie banner
Two of the three cookies are strictly necessary: without them you cannot sign in and cannot create an account. The third stores a language code you chose yourself. None of them track you across sites, build a profile or feed an advertising network, so there is nothing here to consent to beyond using the service.
How the session cookie is protected
- HttpOnly — JavaScript on the page cannot read it, so a script injection cannot steal your session.
- Secure — it is only sent over HTTPS when the request arrives over HTTPS.
- SameSite — it is not sent along with cross-site requests, which is what stops another site acting as you.
- Server-side — the cookie is only a pointer. Revoking the session on the server is what actually ends it.
Other browser storage
StreamBoost does not use local storage or IndexedDB to hold anything about your identity. Your session lives in the cookie above and in the database.
Managing cookies
You can clear or block cookies in your browser settings. Blocking thesession or sb_ctx cookies will prevent you from signing in or creating an account, because those are the mechanisms that make those actions work.
Related
What is stored server-side, and for how long, is described in the Privacy Policy.