Small browser tools, named plainly.

This notice inventories the first-party cookies and browser storage PosMeet actually uses. It separates a sign-in cookie from sensitive text that can remain in one tab, because those risks are not the same.

Reviewed September 30, 2026 · Current limited Web BetaPolicy overview

No ad cookies

The current PosMeet code does not set advertising or cross-site behavioral-tracking cookies.

Session token protected

The production sign-in cookie is unavailable to page scripts and is sent only over HTTPS.

Draft recovery is optional

Story text stays in the current tab only after you turn draft recovery on.

Shared devices need care

Someone with access to the same browser tab may be able to see an unfinished draft.

Current choice model

PosMeet currently uses only essential sign-in, security and interface storage, plus an optional draft chosen inside the composer. There is no advertising or analytics-cookie switch because those optional trackers are not installed. PosMeet must add a real consent control before introducing non-essential analytics or advertising storage.

The short answer

Cookies are small values sent with web requests. Session storage is data held by one browser tab. PosMeet uses both, for different reasons.

The essential member cookie proves that a signed-in request belongs to an active session; it does not contain a profile or health record.
A bundled sidebar helper is capable of remembering one display preference, but no current PosMeet member page mounts that helper.
An unfinished Story can include sensitive text. PosMeet keeps it in tab storage only when you select the draft option.
PosMeet does not currently place Meta, Google advertising or other cross-site marketing tags on member surfaces.

This is part of the Privacy Policy

The Privacy Policy explains the people, purposes, visibility and retention around account and community information. This page gives the device-level inventory that is easy to miss in a broader notice.

Cookies PosMeet sets

The current signed-in member experience relies on one authentication cookie. A dormant interface helper is listed separately so future activation cannot be mistaken for existing use.

posmeet_session First party

Keeps a signed-in member connected. The browser holds a random token; PosMeet stores only its hash in the session record.

Duration: Normally 30 days. The server configuration can shorten it to 1 day or extend it to no more than 90 days.
Protection: HttpOnly and SameSite=Lax. Secure is added in production, so browser scripts cannot read the token and HTTPS is required.

Dormant sidebar helper

The shared interface library contains code that could set a sidebar_state preference for seven days. Current PosMeet pages do not mount that component, so this cookie is not normally set in the member experience. If the helper is activated later, it should store only expanded or collapsed state—not account, health, post or Journal information.

Development-only and legacy names

Local development can use separate member-demo and operator-session cookies for up to seven days and eight hours respectively. They are development shortcuts and are disabled in production. The server may still recognize earlier beta cookie names only so it can clear or safely retire those sessions; new member sessions use the PosMeet name.

Deleting a cookie does not delete an account

Clearing the session cookie signs this browser out, but the account and its server records remain. Use Account & data if you want to start account deletion.

Storage in this browser

The current PosMeet application does not write its own Local Storage records. It uses tab-scoped Session Storage for three functional states.

Optional Story draft

posmeet:story-draft:…

Story type, title, body, selected topics, Profile or Anonymous choice and the save time.

Lifetime: Off by default. When you choose Keep a draft in this tab, it lasts for up to 24 hours and is removed after publishing, discarding, expiry or sign-out.

Sign-in return path

posmeet:sign-in-return

An approved PosMeet page path so the site can return you to the feature you were opening after email sign-in.

Lifetime: Used once and removed immediately, or ignored after one hour. It does not store the page contents.

Journey notice flag

posmeet:journey-notice:tab

The word “shown,” used only to avoid repeating the same private Journey notice in one tab session.

Lifetime: Ends when the tab session ends. It does not contain XP, a keepsake identifier or contribution history.

A draft can be more sensitive than a cookie

A Story draft can contain names, symptoms or relationship details. Leave draft recovery off on a shared device, discard the draft when finished and sign out before handing the device to someone else. Images selected for a Story are not stored inside Session Storage.

Third-party technology and browser state

Loading an external service can create technical state even when PosMeet does not use it for advertising.

The Agora browser software is loaded only for live voice-room audio. Like other real-time communication software, it may maintain short-lived connection state or device preferences needed to create and recover an audio session. PosMeet does not use that technology to build an advertising profile.

Standard images are requested through Amazon CloudFront. Those network requests expose ordinary delivery information—such as the requested object, IP address and browser request metadata—to the delivery service. Private Journal audio and feedback images use authorized, short-lived access rather than the public media path.

See the service-provider registerReview what AWS, Agora and Resend do, when they receive data and what PosMeet still needs to publish.

Your controls

Browser controls are useful, but they have different effects from PosMeet account controls.

Sign out: revokes the server session, clears member session cookies and removes saved Story drafts from Session Storage.
Discard a draft: removes that draft immediately without publishing it.
Clear site data: removes browser-side cookies and storage, but not posts, Journal entries or account data held by PosMeet.
Block all cookies: can prevent sign-in and other authenticated features from working.

Account & data Sign-in requiredSign out, export available data or start account deletion.Read the Privacy PolicySee server-side information, visibility, retention and rights.

Changes and contact

This inventory must change when the code changes—not months later.

PosMeet should update this page before adding a new cookie, SDK or device-storage purpose. A non-essential analytics or advertising tool also needs an appropriate consent and withdrawal flow before it is activated for members.

Policy UpdatesSee version-specific archives, change history and unfinished re-consent delivery.Ask a private question Sign-in requiredTell the PosMeet team if a storage explanation is unclear.