The website and your workspace
Cookies and localStorage support sign-in, workspace selection, language, theme and communication between tabs. The inventory below describes the current platform code, not every customer-published PWA.
The platform shows a notice about necessary cookies on your first visit. “Accept necessary” closes it and remembers your acknowledgement for 180 days; “Cookie settings” reopens it. The current marketing pages do not include optional analytics or advertising scripts. Acknowledging the notice does not authorize future optional tracking. If optional tracking is introduced, it must be blocked until the required consent is obtained, with an equally accessible refusal and withdrawal option.
Platform storage inventory
Cookies are sent with matching requests. localStorage stays in your browser and is accessed by the site. The lifetimes below describe browser storage, not retention of server-side records.
| Name | Storage | Purpose | Lifetime |
|---|---|---|---|
__Host-tt_google_binding / __Host-tt_google_pending / __Host-tt_google_locale | Cookie | Protects Google sign-in and remembers its pending step and language. HttpOnly, Secure, SameSite=Lax; created only when you start Google sign-in. Local development omits the __Host- prefix. | Up to 10 minutes; removed when sign-in completes or fails. |
tt_cookie_notice | localStorage | Remembers that you acknowledged the necessary-cookie notice. It does not authorize advertising or analytics tracking. | 180 days; an expired record is removed on the next visit. |
__Host-tt_session | Cookie | Keeps you signed in. HttpOnly, Secure, SameSite=Lax. Named tt_session in local development. | 7 days after it is set; server-side expiry or revocation can end access earlier. |
tt_account | Cookie | Remembers the workspace selected in your account. | Browser session; some browsers restore session cookies. |
NEXT_LOCALE | Cookie | Remembers the interface language. | 1 year after it is set. |
tt_theme | localStorage | Remembers the light or dark theme you select. | Until you clear site storage; overwritten when you change the theme. |
tt-auth-scope-change | localStorage | Signals a login or workspace change to other tabs. Contains a random signal, not a password or session token. | Until you clear site storage; replaced by the next account event. |
Network protection
The service uses Cloudflare at the network boundary. A challenge or bot-protection feature can set additional security cookies depending on the deployed configuration. Their exact names, purposes and lifetimes must be verified for the launch domain and added to this inventory if active.
Customer PWA storage and push
Customer PWA origins have a separate storage lifecycle, including the tt_dt device cookie (14 days), device/attribution state, a service worker and app caches. They are not automatically classified as essential platform cookies.
Each PWA owner must disclose its storage and tracking and obtain any required consent before non-essential tracking starts. Browser permission for push notifications is a separate choice and does not authorize unrelated advertising tracking.
Managing storage
You can inspect and remove cookies and site data in your browser settings. Blocking session cookies prevents sign-in; clearing site data can sign you out and reset your preferences. Browser push settings control future notification permissions.
Clearing local storage does not erase information already sent to servers. Use the privacy-request process for access or deletion of server records.