Cookies and local storage
Browser data for sign-in, preferences and draft recovery.
On this page
01Authentication
nd_access is an HttpOnly authentication cookie lasting 15 minutes. nd_refresh is an HttpOnly refresh cookie issued for up to 30 days and replaced when a session is refreshed. Revocation or expiry may end a session earlier. Both support the sign-in you request and use SameSite=Lax; Secure must be enabled in production. Blocking them prevents normal authenticated use.
02Preferences
loom-public-theme in localStorage remembers your public-page theme on this browser until you change it or clear site data. It contains a display preference, not note content. Application preferences are also stored with your account on the server so they can be restored when you sign in.
03Unsent drafts
Account-specific localStorage entries beginning loom-drafts hold edits awaiting successful saving and drafts preserved after an interruption or conflict. Each tab keeps its own recovery stream. Entries beginning loom-draft-review record which preserved revisions have been reviewed. Successfully saved edits are removed from the active draft stream. Signing out does not automatically erase recovery drafts. Browser storage is not end-to-end encrypted and may be available to someone with access to your browser profile. Save or copy needed work before clearing it.
04Demo and cache
The current landing animation does not store editable demo documents. Older interactive previews may have left loom-public-demo-v1 or loom-demo-played sessionStorage entries until the tab’s stored data is cleared; the current animation does not use or upload them. Browsers may retain tab storage when restoring a session and cache static files under HTTP caching rules. Clearing cache does not erase server records.
05Optional technologies
The current public interface has no advertising or analytics trackers. If non-essential technologies are introduced, their purposes, recipients and duration must be disclosed and any required prior choice provided. Authentication is not blanket consent to tracking.
06Your controls
Inspect or remove cookies and local storage through your browser’s site-data settings. This may sign you out, reset preferences or discard recovery drafts. Blocking all storage can impair editing and recovery. Browser controls do not delete your account, shared content or server backups; use the Contact and requests process for those requests.