legal · updated 2026-10-18
cookie policy
diff social uses a few cookies and a little browser storage, all of them needed for the service to work or to remember a choice you made. There are no advertising, analytics or tracking cookies, and nothing follows you to other sites. Because every one of them is strictly necessary, the service does not ask for cookie consent.
what we set
| name | kind | what it is for | how long |
|---|---|---|---|
| ds_session | cookie: HttpOnly, Secure, SameSite=Lax | keeps you signed in; the server keeps only its hash | 30 days, or until you sign out |
| ds_signin | cookie: HttpOnly, Secure, SameSite=Lax | one sign-in in progress, against forged sign-ins | 10 minutes |
| ds_link | cookie: HttpOnly, Secure, SameSite=Lax | one GitHub link in progress, against forged links | 10 minutes |
| diffsocial.guest | browser storage | a guest’s random id, so a guest’s messages stay theirs | until you clear it |
| diffsocial.name | browser storage | the name a guest chose | until you clear it |
| diffsocial.tenant | browser storage | the tenant you last chose | until you clear it |
| diffsocial.wrap | browser storage | whether long diff lines wrap | until you clear it |
HttpOnly cookies cannot be read by scripts in the page, and Secure ones travel only over encrypted connections.
other sites we send you to
Signing in happens on our identity provider’s page (WorkOS), and paying on Stripe’s checkout and billing pages. Those pages are on their own sites and set their own cookies under their own policies; we cannot read them.
your choices
You can delete these cookies and this storage in your browser’s settings at any time. Deleting ds_session signs you out; deleting the rest resets a guest’s name and your choices. Blocking them stops sign-in from working.
This policy is part of the privacy policy. Questions: dj@codetestcode.io.