Cookie Notice

The short version

We use two cookies. Both exist to keep you signed in securely. We do not set advertising cookies, we do not use third-party analytics or tracking pixels, and we do not sell or share browsing data.

Because both cookies are strictly necessary to provide a service you have asked for, we do not show a consent banner for them. If we ever add non-essential cookies, we will ask for consent first.

The cookies we set

• tt_access — your short-lived session token, used to authenticate each request. Expires after 15 minutes by default.
• tt_refresh — used only to obtain a new session token when the first expires, so you are not signed out mid-task. Expires after 30 days by default, and is scoped so the browser sends it only to the token-refresh endpoint.

How they are protected

• Both are httpOnly, so JavaScript running in the page cannot read them. This limits the damage a cross-site scripting flaw could do.
• Both are marked Secure in production, so they are only ever sent over HTTPS.
• Both use SameSite=Lax, which stops them being sent on cross-site requests and mitigates cross-site request forgery.
• By default no Domain attribute is set, which binds them to the exact host that issued them rather than sharing them across subdomains.
• Refresh tokens rotate on each use. If an old one is replayed, we treat it as a compromise and revoke the session.

Controlling cookies

You can block or delete cookies in your browser settings. Because ours are strictly necessary, blocking them will prevent you from signing in — the platform cannot function without them.

We do not set cookies at all on the public marketing pages until you sign in.

Questions

If you have a question about our use of cookies, contact privacy@timetravel.com. Our Privacy Policy explains how we handle personal data more broadly.