Cookie Policy

Last updated 11 Oct 2026.

Terms of Service · Privacy Policy · Cookie Policy · Community Guidelines

buncol uses only a few cookies, and only to log you in and keep you logged in. They are all set by our own domain. There are no analytics, advertising or social media cookies, and no third-party cookies of any kind.

The cookies we use

Cookie What it is for Settings Lifetime
jwt Proves that you are logged in. It holds your account ID, your login session, how much the login may do and when the token was issued and expires, signed by the server. HttpOnly, SameSite=Lax, Secure when the site is served over HTTPS 4 hours at most; a new one is issued while you stay logged in. Without "Keep me logged in": until you close the browser
remember_token Keeps you logged in on this browser between visits, so you do not need a new login code every time. It holds a random value; our server keeps only a hash of it, with the login session it belongs to. HttpOnly, SameSite=Lax, Secure when the site is served over HTTPS As long as you chose in the login settings (30 days unless you changed it), counted from your last visit. Without "Keep me logged in": until you close the browser
device Only on a browser you trust (in your login settings): says it is trusted, so it can log in with your password and use the settings you gave it. It holds a random value for each account that trusts this browser; our server keeps only a hash of each. HttpOnly, SameSite=Lax, Secure when the site is served over HTTPS 400 days after the browser was last used. It stays when you log out, until you forget the browser in your login settings
Session cookie (usually PHPSESSID) Links your browser to your session on the server: short one-time messages, such as "we sent you a login code", and the one-time challenge while you add or use a passkey. HttpOnly, Secure, SameSite=Lax Until you close the browser

If you are not logged in you normally get no cookies at all. The session cookie is only set when the site has to remember something between two pages, for example the message that a login code was sent.

No other storage or tracking

  • The site does not store anything in your browser's local storage, session storage or IndexedDB.
  • Your browser only loads files from our own domain. There are no external fonts, scripts, embeds, tracking pixels or content delivery networks.
  • While you are logged in, the page checks in with the server every 10 minutes so you are not logged out while you work. This uses the cookies above and nothing else.

Why there is no cookie banner

The law (the EU ePrivacy rules and the GDPR) requires consent for cookies unless they are strictly necessary to provide a service you asked for. All of our cookies are strictly necessary for logging in and staying logged in, so we do not need to ask for consent, and showing a banner would only get in your way. If we ever add a cookie that is not strictly necessary, we will ask you first and update this page.

Removing cookies

  • Log out to remove the jwt and remember_token cookies, delete the matching record on our server and end your session.
  • Forget a browser in your login settings to make it untrusted: its device cookie then matches nothing, and is removed when you forget the browser you are using.
  • Deleting your account does the same, and deletes the "stay logged in" records of all your browsers: the cookies left in your other browsers no longer log anyone in, and are removed on their next visit.
  • You can also delete cookies for this site in your browser's settings, or block them. Without cookies you can still read public pages, but you cannot log in.

More about what we store is in the Privacy Policy. Questions: info@llmpeeters.com.