Pirl Cookie Policy
Last updated: October 5, 2026 (revision 1)
Necessary and optional technologies
Necessary cookies support authentication and security. Optional Meta advertising is disabled until explicitly accepted and can be withdrawn through Cookie settings. Your choice is stored separately from the marketing website for one year in browser local storage under pirl.cookie-consent; invalid, expired, or outdated choices disable advertising. Browser settings can clear stored information, but blocking necessary cookies can prevent sign-in.
Necessary cookie inventory
dashboard_session — Pirl sign-in session; browser-session lifetime for ordinary sign-in, or the remaining remembered-session lifetime when Keep me signed in is selected. dashboard_csrf — Pirl protection against forged authenticated commands; matches the session cookie lifetime.
dashboard_signup — Pirl binding of email verification to the signup browser; 24 hours. dashboard_device — Pirl recognition of browsers used before; one year; signed digests for the last five accounts, not plaintext account identifiers. OAuth state — short-lived state needed for the Google callback; Pirl uses the signed better-auth.state cookie for five minutes; server-side OAuth verification state expires after ten minutes. Turnstile may process browser/device/network signals and use necessary verification technology under Cloudflare's Turnstile privacy addendum.
Meta advertising cookies
Meta may set _fbp and _fbc when marketing is accepted, to associate permitted advertising events with a browser or ad click. Pirl's permission itself lasts at most one year. Withdrawal stops new advertising events and expires accessible host and parent-domain Meta cookies; it does not recall information previously received by Meta.
Your choices
Accept optional cookies, Reject optional cookies, and Save preferences are available separately. Necessary cookies remain active. Cookie settings is accessible from authentication screens and the dashboard. No advertising script loads on token-bearing pages or on authenticated dashboard pages. Marketing consent does not subscribe you to emails or determine your customer-data processing basis.