Cookies | CanITrustThat

Public pages set one cookie, theme, and only when you use the theme toggle. The signed-in app sets the other cookies below, each needed for signing in or for the app's layout. None is used for advertising or analytics.

Cookies of the site and the signed-in app

Name	Purpose	Lifetime
`__Host-citt_session`	Keeps you signed in; not readable by scripts	24 hours
`__Host-citt_refresh`	Renews the session; not readable by scripts	30 days
`citt_signed_in`	Its value is always "1"; set for canitrustthat.com so the public site's header shows "Dashboard" instead of "Sign in"	30 days
`sidebar_state`	Stores whether the app's sidebar is open	7 days
`theme`	Stores the chosen colour theme, `light` or `dark`; set only when you use the theme toggle on the public site or in the app; first-party, SameSite=Lax	One year

Subscriber pages

When you open the link in a subscription email, the subscription service (Ghost, hosted on our own server) issues its ghost-members-ssr and ghost-members-ssr.sig sign-in cookies to our web server. The web server uses them for that one request to read your subscription settings, then ends the Ghost session. The page that opens in your browser sets no cookie.