Far — Cookie Policy
DRAFT — requires review by qualified counsel before publication. Effective date: [DATE]
Far uses only cookies that are strictly necessary to sign you in and keep the service secure. We set no analytics, advertising, or cross-site tracking cookies. Because every cookie we set is strictly necessary, EU/UK ePrivacy rules do not require a consent banner — which is why you don't see one. If that ever changes, a consent mechanism will be added before any non-essential cookie is set.
Cookies we set
All are set by our authentication layer (Auth.js) and are first-party:
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
__Secure-authjs.session-token (or authjs.session-token in dev) |
Keeps you signed in (encrypted session token) | Strictly necessary | [30 days — VERIFY configured maxAge] |
__Host-authjs.csrf-token |
Protects sign-in forms against cross-site request forgery | Strictly necessary | Session |
__Secure-authjs.callback-url |
Returns you to the right page after sign-in | Strictly necessary | Session |
[__Secure-authjs.pkce.code_verifier / state / nonce] |
Secures the Google sign-in handshake | Strictly necessary | ~15 minutes |
Local storage
Your theme preference (light/dark) is stored in your browser's local storage. It never leaves your device.
Third-party requests (not cookies)
Map imagery, weather, and trail data are fetched by your browser from the providers
listed in the [Privacy Policy §6] and [/legal/subprocessors]. Those requests carry your
IP address as any web request does. Mapbox, our map provider, also sends an
anonymized usage-metering request (events.mapbox.com) each time the map loads —
this is how Mapbox counts map loads for billing and cannot be turned off while using
their map tiles; it does not set a cookie and does not identify you personally. No map
provider sets a tracking cookie in your browser [VERIFY].
Managing cookies
You can delete or block cookies in your browser settings; blocking the session cookie will sign you out and prevent sign-in.
Questions: [privacy@far.app].