01What this policy covers
In short: We only use what's needed to sign you in, keep you safe and remember your UI choices.
Cookies are small text files a website asks your browser to keep. Browsers also offer “local storage”, which works similarly but is never sent to our servers automatically. This policy explains both, for santiauth.com, the dashboard, and the public key and giveaway pages that SantiAuth hosts for creators.
02Essential cookies
In short: Sign-in cookies set by our authentication system. The site can't work without them.
These cookies are set by our API when you sign in to the dashboard. They are HttpOnly (JavaScript can't read them), sent only over HTTPS in production, where their names get a __Secure- prefix, and are never used for anything other than authentication and security.
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token | Keeps you signed in to the dashboard. HttpOnly and signed, so scripts on the page can't read it. | 7 days, renewed while you're active |
better-auth.session_data | Short-lived signed copy of your session so each request doesn't need a database lookup. | About 1 minute |
better-auth.two_factor | Links the password step and the 2FA code step of a single sign-in. | Up to 10 minutes |
better-auth.trust_device | Set only if you tick “Trust this device” on the 2FA screen, so we don't ask for a code on this browser again. | 30 days |
better-auth.state | Protects Discord and Google sign-in against request forgery (CSRF) while you're redirected to the provider. | Up to 5 minutes |
better-auth.session_token- Purpose
- Keeps you signed in to the dashboard. HttpOnly and signed, so scripts on the page can't read it.
- Duration
- 7 days, renewed while you're active
better-auth.session_data- Purpose
- Short-lived signed copy of your session so each request doesn't need a database lookup.
- Duration
- About 1 minute
better-auth.two_factor- Purpose
- Links the password step and the 2FA code step of a single sign-in.
- Duration
- Up to 10 minutes
better-auth.trust_device- Purpose
- Set only if you tick “Trust this device” on the 2FA screen, so we don't ask for a code on this browser again.
- Duration
- 30 days
better-auth.state- Purpose
- Protects Discord and Google sign-in against request forgery (CSRF) while you're redirected to the provider.
- Duration
- Up to 5 minutes
Because these cookies are strictly necessary for a service you asked for, the law doesn't require consent for them, and that's why we don't show a cookie banner.
03Local storage
In short: UI preferences and your key progress stay in your browser. We never read them from the server.
Local storage stays on your device until you clear it. We use it for preferences and for progress that should survive a reload. Nothing here identifies you to us or is shared with anyone.
Dashboard and website
| Key | Purpose | Used on |
|---|---|---|
theme | Light, dark or system theme. | Whole site |
dashboard:palette-v2 | Accent colour palette you picked. | Dashboard |
dashboard:sidebar-*, dashboard:service-sidebar-nav, admin:nav:open | Which sidebar groups are collapsed or expanded. | Dashboard |
dashboard:last-service | Opens the service you worked on last. | Dashboard |
santiauth:onboarding-collapsed, ai:sidebar-collapsed | Whether you collapsed the getting-started card and the AI assistant panel. | Dashboard |
theme-studio:panel, theme-studio:recent-colors | Theme editor panel layout and recently used colours. | Dashboard |
| List view and draft keys | Table/grid view choice and unsaved drafts, so you don't lose work on reload. | Dashboard |
theme- Purpose
- Light, dark or system theme.
- Used on
- Whole site
dashboard:palette-v2- Purpose
- Accent colour palette you picked.
- Used on
- Dashboard
dashboard:sidebar-*,dashboard:service-sidebar-nav,admin:nav:open- Purpose
- Which sidebar groups are collapsed or expanded.
- Used on
- Dashboard
dashboard:last-service- Purpose
- Opens the service you worked on last.
- Used on
- Dashboard
santiauth:onboarding-collapsed,ai:sidebar-collapsed- Purpose
- Whether you collapsed the getting-started card and the AI assistant panel.
- Used on
- Dashboard
theme-studio:panel,theme-studio:recent-colors- Purpose
- Theme editor panel layout and recently used colours.
- Used on
- Dashboard
- List view and draft keys
- Purpose
- Table/grid view choice and unsaved drafts, so you don't lose work on reload.
- Used on
- Dashboard
Key pages and giveaways
| Key | Purpose | Used on |
|---|---|---|
pk_flow_<service> | Your progress through a key system's checkpoints, so a reload or an ad-link redirect doesn't restart it. | Key pages |
pk_keys_<service> | Up to 12 keys you received on this device, shown under “Recent keys”. You can remove them from the page. | Key pages |
gw_s_<giveaway>, gw_keys_<giveaway> | Your giveaway claim session and up to 12 keys claimed on this device. | Giveaways |
pk_flow_<service>- Purpose
- Your progress through a key system's checkpoints, so a reload or an ad-link redirect doesn't restart it.
- Used on
- Key pages
pk_keys_<service>- Purpose
- Up to 12 keys you received on this device, shown under “Recent keys”. You can remove them from the page.
- Used on
- Key pages
gw_s_<giveaway>,gw_keys_<giveaway>- Purpose
- Your giveaway claim session and up to 12 keys claimed on this device.
- Used on
- Giveaways
04Third-party services
In short: Some pages hand you over to Discord, Google, Cloudflare or an ad-link provider, and they apply their own policies.
We don't embed third-party trackers, but some features hand you over to other services:
- Cloudflare Turnstile
- The anti-bot check some creators enable on key and giveaway pages. It processes technical signals to tell humans from bots. Privacy addendum
- Discord and Google sign-in
- If you choose them, you're redirected to their sites, which set their own cookies. Discord · Google
- Ad-link providers
- Linkvertise, Lootlabs, Work.ink, Boostellar and others. Completing a checkpoint opens their site, which may set advertising cookies under its own policy.
05Your choices
In short: You can block or clear everything in your browser settings, but you'll be signed out.
- Clear or block cookies in your browser settings. Blocking the essential cookies means you can't sign in to the dashboard.
- Clear local storage through your browser's site-data settings. You'll lose preferences and the list of recent keys on this device, not your account or your keys.
- Remove a single key from “Recent keys” on a key or giveaway page with the forget button.
- Signing out deletes the session cookies right away. You can also end sessions on other devices from Settings → Sessions.
Because we don't track you across sites, there's nothing for “Do Not Track” or Global Privacy Control signals to switch off.
06Changes and contact
If we add a new cookie or storage key, we'll update this page and its date. If we ever want to use non-essential cookies, we'll ask for your consent first. Questions go to legal@santiauth.com. See the Privacy Policy for how we handle personal data in general.