Cookie Policy
Effective 8 October 2026
Weave uses only the cookies needed to sign you in and keep your session secure. We do not use analytics, advertising or social-media tracking cookies, so we do not ask for cookie consent.
1. What cookies are
Cookies are small files a website stores in your browser. Similar technologies, such as your browser's local storage, work in a similar way. Under the Privacy and Electronic Communications Regulations 2003 (PECR), a website must ask for consent before storing information on your device unless it is strictly necessary to provide a service you have asked for.
2. Cookies we set on www.weave.directory
All of these are first-party, strictly necessary cookies set by our sign-in system (NextAuth.js). They are marked Secure (sent only over HTTPS) and HttpOnly (not readable by scripts) and use SameSite=Lax.
| Cookie | Purpose | Duration |
|---|---|---|
__Secure-next-auth.session-token | Keeps you signed in. Holds an encrypted session token identifying your account. Large tokens may be split across cookies ending .0, .1 and so on. | 30 days from your last sign-in or session refresh; removed when you sign out |
__Host-next-auth.csrf-token | Protects sign-in and sign-out forms against cross-site request forgery. | Session (deleted when you close your browser) |
__Secure-next-auth.callback-url | Remembers which page to return you to after you sign in. | Session |
__Secure-next-auth.state, __Secure-next-auth.pkce.code_verifier, __Secure-next-auth.nonce | Only if you sign in with GitHub or Google: secure the sign-in handshake with the provider against forgery and replay. | Up to 15 minutes, during sign-in only |
3. Local storage
| Key | Purpose | Duration |
|---|---|---|
theme | Remembers the light, dark or system theme you choose. Set only when you choose a theme. | Until you clear your browser storage |
This stores a choice you have made yourself, so it is exempt from consent under PECR. Signed-in users' theme choice is also saved to their account.
4. Third-party sites
When you choose to sign in with GitHub or Google, or pay through Stripe's hosted checkout page, you visit those providers' own websites, and they may set their own cookies under their own cookie policies. We do not load third-party scripts, analytics, advertising pixels or embedded social-media widgets on Weave pages. Our web fonts are served from our own domain.
5. Controlling cookies
You can block or delete cookies in your browser settings. If you block the cookies above, you will not be able to sign in to Weave. The Weave CLI does not use browser cookies; it authenticates with a personal access token you create.
6. Changes and contact
If we ever want to use a cookie that is not strictly necessary, we will update this policy and ask for your consent first. Questions: privacy@weave.directory. See also our Privacy Policy.