COOKIE
POLICY

Session management and authentication

__Secure-better-auth.session_token — Authenticates your session after sign-in. Duration: 7 days (rolling). Provider: Xeito (first-party, set by BetterAuth). HttpOnly, Secure, SameSite=Lax, Domain=.xeito.ai. In local development the cookie is named better-auth.session_token (no __Secure- prefix) because it is served over HTTP.

__Secure-better-auth.session_data — Caches non-sensitive session metadata so we can avoid hitting the auth database on every request. Duration: matches the session token. Provider: Xeito (first-party, set by BetterAuth). HttpOnly, Secure, SameSite=Lax, Domain=.xeito.ai.

__Secure-better-auth.dont_remember — Set only when you sign in without "remember me", so the session ends when you close the browser. Duration: session. Provider: Xeito (first-party, set by BetterAuth). HttpOnly, Secure, SameSite=Lax.

better-auth.state_* / better-auth.pkce_* — Short-lived CSRF state and PKCE verifier cookies used during OAuth sign-in flows (Google, GitHub, LinkedIn) and email-verification redirects. Duration: 10 minutes. Provider: Xeito (first-party, set by BetterAuth). HttpOnly, Secure, SameSite=Lax. Deleted as soon as the OAuth round-trip completes.

Stripe (payment security — Stripe Payments Europe Ltd, Ireland)

__stripe_mid — Machine identifier for fraud detection. Duration: 1 year. Provider: Stripe. Set only on payment pages.

__stripe_sid — Session identifier for fraud detection. Duration: 30 minutes. Provider: Stripe. Set only on payment pages.

m — Device fingerprint for fraud prevention. Duration: 2 years. Provider: Stripe. Set only on payment pages.

Cloudflare (network security — Cloudflare, Inc., USA)

__cf_bm — Bot management and abuse prevention. Duration: 30 minutes. Provider: Cloudflare.

_cfuvid — Rate limiting to protect against abuse. Duration: Session. Provider: Cloudflare.