Cookie policy
Buteo sets 5 cookies: three to sign you in, one to protect the free trial and one to remember your sidebar. None is for advertising. Page views are counted only if you say yes, and counting them uses no cookie.
By Buteo · Updated
Does Buteo use cookies?
Yes: 5 of them, and each does a job the app cannot do without. None is for advertising, and none follows you to another site.
Because none of them is optional, none is asked about. The one thing Buteo does ask about is page-view statistics, which use no cookie at all and are described below.
Which cookies does Buteo set?
| Cookie | What it is for | How long it lasts |
|---|---|---|
| authjs.session-token | Keeps you signed in. Without it the app cannot tell who you are. | 30 days |
| authjs.csrf-token | Proves that a sign-in or sign-out request came from Buteo's own page and not from another site. | Until you close the browser |
| authjs.callback-url | Remembers which page to return you to after signing in. | Until you close the browser |
| __Host-bd | A random identifier, set when you register, used only to stop one person claiming the free validation many times. | 400 days |
| sidebar_state | Remembers whether you left the sidebar open or collapsed. | 7 days |
Over a secure connection the three sign-in cookies carry a __Secure- or __Host- prefix, which stops any other site from setting them.
The device cookie is stored on Buteo's side only as a keyed hash. What it is compared against, and why, is in the privacy policy.
What does the cookie banner ask about?
Whether Buteo may count the pages you view. Pages are counted only if you allow it, and never before you answer. The statistics are not tied to your account, and gathering them sets no cookie.
Saying no changes nothing about how the app works. You can change your answer at any time with “Cookie settings” at the foot of any public page.
What else is kept in your browser?
Three things that are not cookies but work in a similar way:
- Your theme, light or dark.
- Your answer to the statistics question, so that it is not asked on every page.
- A push subscription, only if you turn browser alerts on. It is how a verdict reaches you with the tab closed.
The first two stay in your browser and are never sent to Buteo. The subscription is sent, so that there is somewhere to deliver an alert to, and is deleted with your account.
Do other companies set cookies?
Buteo's pages load no advertising and no social-media scripts. Two things do involve somebody else:
- Paying. The checkout and the billing portal are pages on Polar's site, not Buteo's. Polar sets its own cookies there, under its own policy.
- Source icons. Inside the app, the small icon beside each source is fetched by your browser from Google's icon service, which is told which site's icon was asked for. Buteo sets no cookie through it, and Google handles that request under its own policy.
How do you remove or block them?
In your browser's settings, where every cookie a site has set can be seen, deleted or blocked.
- Signing out removes the session cookie. Blocking it means you cannot sign in.
- The device cookie and the sidebar cookie can be deleted at any time without breaking anything.
- Clearing the site's stored data resets your theme and puts the statistics question back.
Will this policy change?
When the app starts or stops setting a cookie, this page changes and so does the date at the top. What Buteo stores about you on its own side is in the privacy policy.