Cookie Policy

Every cookie and browser-storage key Alpha Sierra Pilot uses, what each one is for, and why there is no consent banner.

Version 1.0 · In effect from 9 September 2026

This is the complete list. There is no analytics cookie, no advertising cookie, no tracking pixel and no third-party script watching you read a lesson — and that is a design decision, not an oversight.

1. What a cookie is here

A cookie is a small file a site asks your browser to keep and send back on the next request. We use them for one thing: to know that the person asking for your dashboard is you. We also use a little of your browser's local storage for small conveniences, which never leaves your device — those are listed in section 3 for completeness even though they are not cookies.

2. The cookies we set

Cookie	Purpose	Lifetime	Category
`__Secure-authjs.session-token`	Keeps you signed in. Holds a signed token identifying your session — not your password. Not readable by scripts.	Up to 30 days	Strictly necessary
`__Host-authjs.csrf-token`	Protects sign-in and account forms against cross-site request forgery.	Until you close the browser	Strictly necessary
`__Secure-authjs.callback-url`	Remembers the page you were heading to so you land there after signing in.	Until you close the browser	Strictly necessary
`__Secure-authjs.pkce.code_verifier`	Only if you use "Sign in with Google": secures that exchange. Discarded as soon as sign-in completes.	Minutes	Strictly necessary
`asp-auth-hint`	A marker holding the value "1". Lets us tell "your session expired while you were away" apart from "you were never signed in", so we can show the right message. Contains nothing about you.	Matches your session; cleared on sign-out	Strictly necessary
`asp-theme`	Remembers whether you chose the light or dark theme, so the first paint is right. Set only when you use the theme toggle.	1 year	Preference (set by your own action)

All cookies set by alphasierrapilot.com

Cookie names carry the __Secure-/__Host- prefixes on our live site; in local development the same cookies appear without them.

3. Browser storage (not cookies, never sent to us)

Key	Where	What it does
`asp.selected-aircraft`	Local storage	Remembers which aircraft you last had selected, so screens open on it.
`asp-teaser-seen`	Local storage	So the sample-question card on the landing page is offered once, not on every visit.
`asp-fact-shown`	Session storage	So the aircraft-fact card appears at most once per browsing session.
`asp-tz-synced`	Session storage	So your device time zone is sent once per session rather than on every page load.

These stay in your browser. Clearing your site data removes them, and nothing breaks — the app simply forgets a preference.

4. Why there is no cookie banner

EU rules require consent before storing anything on your device except what is strictly necessary to provide the service you asked for, and preferences you set yourself. Everything in section 2 falls into one of those two categories: sign-in, security, and a theme switch you clicked.

We set nothing for analytics, measurement, profiling or advertising, so there is nothing for you to consent to and nothing to refuse. A banner would only be theatre.

5. Third parties

Stripe. Paying takes you to a checkout page hosted by Stripe. Cookies there are Stripe's, set under Stripe's own policy, and are used for payment processing and fraud prevention. We do not set cookies on that page and we receive no card data from it.
Google. Only if you choose "Sign in with Google": Google's own cookies apply on Google's sign-in page, under Google's policy.
Fonts and assets are served from our own domain. We do not embed third-party font, video, map or social widgets, so nothing loads from a site that could watch you across the web.

6. Controlling cookies

Every browser lets you view, block and delete cookies, and clearing them signs you out here. Blocking the strictly-necessary ones will stop you from signing in at all — there is no way around that, because they are how being signed in works.

Questions about anything on this page: support@alphasierrapilot.com.