Cookies

quillow.session-token is set when you sign in. It holds a signed session token, nothing else. It is HTTP only, so scripts cannot read it, it is marked Secure in production, and it lasts 30 days or until you sign out.

It is strictly necessary for the service. Without it there is no way to know which library to show you.

No advertising cookies. No third party analytics. No social media pixels. No cross site trackers. No fingerprinting. We do not know which other websites you visit and have no way to find out.

If you choose to sign in with Google, Google sets its own cookies on its own domain as part of that sign-in. That is between you and Google and is governed by their policies. We receive your name, email address and profile image, and nothing else.

When card payments are switched on, checkout happens on Stripe's own pages and Stripe sets cookies there to prevent fraud. We do not see your card details at any point.

You can block or delete the session cookie in your browser at any time. You will be signed out and will not be able to open your library until you sign in again, which is the only thing that cookie does.