Cookies and local storage
Browser data for sign-in, preferences and draft recovery.
On this page
01Authentication
nd_access is an HttpOnly authentication cookie lasting 15 minutes. nd_refresh is an HttpOnly refresh cookie issued for up to 30 days and replaced when a session is refreshed. Revocation or expiry may end a session earlier. Both support the sign-in you request and use SameSite=Lax; Secure must be enabled in production. Blocking them prevents normal authenticated use.
02Preferences
loom-public-theme in localStorage remembers your public-page theme on this browser until you change it or clear site data. It contains a display preference, not note content. Application preferences are also stored with your account on the server so they can be restored when you sign in.
03Unsent drafts
Account-specific localStorage entries beginning loom-drafts hold edits awaiting successful saving and drafts preserved after an interruption or conflict. Each tab keeps its own recovery stream. Entries beginning loom-draft-review record which preserved revisions have been reviewed. Successfully saved edits are removed from the active draft stream. Signing out does not automatically erase recovery drafts. Browser storage is not end-to-end encrypted and may be available to someone with access to your browser profile. Save or copy needed work before clearing it.
04Demo and cache
The current landing animation does not store editable demo documents. Older interactive previews may have left loom-public-demo-v1 or loom-demo-played sessionStorage entries until the tab’s stored data is cleared; the current animation does not use or upload them. Browsers may retain tab storage when restoring a session and cache static files under HTTP caching rules. Clearing cache does not erase server records.
05Support and download storage
Session cookies lunume_support_session and lunume_support_download keep a random identifier and remember that the download support window was shown, across tabs on this site. Tab entries beginning lunume:download-support and lunume:support-session provide a fallback; browsers may restore session data. Account-specific support reminders remember active days, the next eligible date and your never-show choice without recording note content. The separate Lunume support/download interaction records contain source, platform, selected amount and currency, and assigned delay, and expire on Lunume’s server after 90 days. Browser Do Not Track or Global Privacy Control disables optional client interaction events. There are no advertising pixels in this feature. Public marketing pages load the controlled analytics SDK from https://control.secretcandies.com; public website chat is available on these pages. Analytics uses no visitor identifier by default; explicit consent enables a random session-scoped identifier, while opt-out, Do Not Track and Global Privacy Control stop optional tracking. The lunume:analytics-consent preference records an explicit choice; controlroom:analytics:lunume sessionStorage holds the consented analytics identifier, and controlroom:chat entries in localStorage hold the separate public-chat visitor token. Account, workspace and shared-note pages do not load these public scripts. Clear browser site data to reset local choices; server-side idea and payment records require a separate request.
06Your controls
Inspect or remove cookies and local storage through your browser’s site-data settings. This may sign you out, reset preferences or discard recovery drafts. Blocking all storage can impair editing and recovery. Browser controls do not delete your account, shared content or server backups; use the Contact and requests process for those requests.