What we store in your browser
2ldr; is built to minimize browser storage. We use no third-party cookies, no advertising cookies, and no behavioral profiling. This page documents everything we DO store, and why.
Last updated: 2026-05-11.
1. Cookies vs. localStorage vs. sessionStorage
Three different browser-side storage mechanisms, each with different scope + lifetime + visibility-to-server. We're transparent about which we use for what:
| Mechanism | What it is | Sent to server? |
|---|---|---|
localStorage | Browser-side key/value store. Up to ~5MB per origin. No expiry unless we clear it. | No |
sessionStorage | Same as localStorage but cleared when you close the tab. | No |
| HTTP-only cookies | Server-set tokens that travel with every request to the issuing domain. | Yes (automatically by browser) |
2. Everything we store
2.1 On 2ldr.ai (marketing site)
Nothing. The marketing site sets no cookies and writes no localStorage. There is no analytics tracking, no consent banner needed because there is nothing to consent to.
2.2 On app.2ldr.ai (admin/viewer SPA)
| Key | Mechanism | Purpose | Lifetime |
|---|---|---|---|
deck-reviewer | localStorage | Your boarding-pass name — so the deck remembers who you are across sessions | Until you clear localStorage |
deck-boarding-profile | localStorage | Your role, lens, coach areas (all optional). Used only locally to customize the downloaded 2ldr.md | Until you clear localStorage |
deck-view-mode | localStorage | Whether you prefer plain or tech reading view | Until you clear localStorage |
2ldr-seen-post-ids | localStorage | UUIDs of post-via-URL-bridge messages you've already applied (prevents re-applying on re-click). Capped at 200 entries; oldest entries evicted | Until you clear localStorage or 200 entries reached |
| Cognito tokens | localStorage (set by Cognito SDK) | Authentication tokens for admin features. Cleared when you sign out | 30 days max (refresh token expiry) |
2.3 On auth.2ldr.ai (Cognito hosted UI)
Cognito's hosted sign-in flow uses session cookies for the authentication transaction. These are set by AWS Cognito and follow AWS Cognito's documented cookie behavior. They are cleared on sign-out.
2.4 On api.2ldr.ai (REST API)
Nothing. Our API does not set cookies. Authentication is bearer-token via the Authorization header when you're signed in.
3. What we do NOT store
- No third-party tracking pixels (no Google Analytics, no Facebook Pixel, no Hotjar).
- No advertising cookies.
- No behavioral profiling.
- No fingerprinting (we do not record canvas hashes, WebGL fingerprints, font lists, etc.).
- No social-network “like” or “share” pixels.
- No cross-site tracking of any kind.
The marketing site does not set any cookies at all. The app sets only what's strictly necessary for the service to function.
4. Your controls
- Browser settings — you can disable cookies entirely or per-site in your browser's privacy settings. If you disable cookies for
auth.2ldr.ai, you won't be able to sign in. - Sign out — clears the Cognito session cookie and your authentication tokens from localStorage.
- Clear localStorage — via your browser's site-data controls. Will reset your boarding-pass profile and view preferences but won't delete data on our servers.
- Delete account — via the in-product Delete-account endpoint or by emailing privacy@2ldr.ai. Removes all data on our servers per the Privacy Policy retention schedule.
5. No cookie banner
Because the marketing site sets no cookies and the app cookies/localStorage are strictly necessary for service functionality, we do not display a cookie consent banner. This aligns with the GDPR “strictly necessary” cookies exemption and the e-Privacy Directive's similar carve-out.
If we ever add cookies that go beyond strictly necessary (e.g., third-party analytics), we'll add a real consent flow at that point.
6. Contact
Questions about what's in your browser:
- Privacy: privacy@2ldr.ai