Cookie & Local Storage Policy
Last updated: October 27, 2026
1. Zero Third-Party Advertising or Cross-Site Tracking Cookies
Mellott.US does not use third-party advertising cookies, retargeting pixels, social media tracking beacons, or cross-site behavioral profiling scripts. Every cookie and browser storage entry set by Mellott.US is strictly first-party and originates from mellott.us.
2. How to Manage or Clear Cookies & Push Subscriptions
You can clear or block cookies at any time through your browser's privacy settings. Note that blocking strictly necessary cookies (__Host-bff_session and __Host-csrf_token) will prevent you from signing in to protected pages, though public informational and compliance pages (such as /sms, /unsubscribe, and /data-deletion) remain fully accessible without cookies. Web Push Service Worker registrations can be revoked at any time in your browser's site permissions.
3. Related Policies & Contact
For broader information on how personal data is collected, encrypted, and deleted, please read our Privacy Policy and Terms of Service, or email support@mellott.us.
4. First-Party Cookie & Storage Inventory
| Cookie / Storage Key | Category | Duration | Purpose |
|---|---|---|---|
| __Host-bff_session / __Secure-bff_session | Strictly Necessary (Authentication) | Session / Configured Login TTL | HttpOnly, Secure, SameSite=Lax session identifier authenticating your signed-in browser session with the Mellott.US Backend-for-Frontend (BFF). |
| __Host-csrf_token | Strictly Necessary (Security) | 24 hours | Double-submit Cross-Site Request Forgery (CSRF) defense token echoed in the X-CSRF-Token header on state-changing requests. |
| mc_device | Strictly Necessary (Security) | 1 year | Associates an authenticated browser with its registered device entry under Settings → Security → Devices so you can review or revoke active sessions. |
| ign_visitor | First-Party Operational & Security Telemetry | 1 year | First-party random identifier used for self-hosted security and operational telemetry on our own servers. Never shared with third parties. |
| localStorage / sessionStorage (Theme, Locale & E2EE Keys) | Functional & Security | Session / Persistent until cleared | Stores your selected UI language (48 locales), light/dark theme preference, and ephemeral X25519 + AES-256-GCM session keys. |