Cookie Policy

Authentication

The hosted HTTPS service uses first-party cookies with Secure and HttpOnly protection. Authentication cookies normally use SameSite=Lax. Names can include a security prefix.

• __Secure-better-auth.session_token: identifies your session. The default lifetime is seven days, renewed during continued use; sign-out clears it.
• __Secure-better-auth.oauth_state or __Secure-better-auth.state: correlates an external sign-in with your browser. These last at most ten or five minutes, depending on the flow, and are cleared when the flow completes.
• __Secure-better-auth.dont_remember: records a choice to use a browser-session login instead of persistent login, when that option is used.
• __Host-citet-saml-…: a one-use university login correlation cookie. It lasts ten minutes and uses SameSite=None so the institution's cross-site login response can return to Citet. It is cleared after the callback.

Citet does not set a separate better-auth.csrf_token cookie. Origin validation and login correlation protect authentication requests. Blocking authentication cookies prevents sign-in.

Preferences and document cache

localStorage holds the citet-theme preference, panel layouts, sandbox content, and presentation state and private presenter notes. These remain until replaced or cleared. They are browser storage, rather than a one-year theme cookie.

IndexedDB can cache Yjs documents and offline edits for synchronization. Document updates are sent to the project collaboration server when connected. These caches can remain on your device after sign-out or account deletion; clear this site's storage in your browser settings, especially on a shared device.

External services

Citet does not use analytics or advertising cookies. If you navigate to an institution, Google, or another connected service to authenticate, that service can set its own cookies under its own policy. Optional integrations and AI data transfers are described in the Privacy Policy.

Managing storage

Use your browser's site settings to inspect or remove cookies, local storage, and IndexedDB for Citet. Removing unsynchronized document caches can discard offline edits.

Last updated: 2026-10-01.