Cookies we set

better-auth.session_token (with __Secure- on HTTPS) holds the session, at most seven days. Short-lived cookies are used in reset and two-factor flows.

pm-locale remembers the language you pick in the language menu, for a year. It is only set when you choose a language.

When you open a file shared with named people by entering the code sent to your address, pm_share_… proves that address in this browser for 24 hours, so you are not asked again. It is only sent to that one shared link.

Theme and density are stored in your browser, not as cookies, and never reach our server.