Only the storage the product needs.

Authenticated access uses a server-managed, HttpOnly session cookie. Login also uses a short-lived state cookie during the identity-provider flow. These cookies support security and access continuity; they are not used for advertising.

The current repository does not configure third-party analytics, advertising pixels, behavioral tracking, or non-essential cookie consent tooling. This statement must be revisited before any new vendor, script, embedded media, or analytics endpoint is introduced.

Service API keys, identity tokens, provider credentials, object keys, signed URLs, media, transcript text, and provider responses must not be placed in browser storage. Short-lived asset capabilities remain scoped to the transfer that needs them.

Adding optional cookies or similar technologies requires a documented purpose, vendor, data flow, retention period, regional consent behavior, opt-out path, and update to the final privacy and cookie policies.