Cookie and Storage Policy
Operator: Diduno, an unincorporated student project run by its founders ("Diduno", "we", "us") Contact: [email protected] Effective date: November 9, 2026 Address: this policy is published at /cookies. Applies to: the Diduno website (web app and installable web app). There is no native mobile app.
This policy lists every cookie and every piece of browser storage Diduno uses, why, and how to control it.
1. Short version
- Diduno sets cookies only to sign you in and keep you signed in. They are strictly necessary.
- Diduno has no advertising cookies, no cross-site trackers and no third-party marketing cookies.
- Our page-view analytics (Vercel Web Analytics) sets no cookie from our code and, according to Vercel's published documentation, none of its own. You can turn it off at /privacy/choices. Diduno also honors the Global Privacy Control signal.
- Diduno stores your display preferences and your saved items in your browser (localStorage).
- Because we use no non-essential cookies, we do not show a cookie consent banner. If that changes, we will add one before the change goes live.
2. What these technologies are
Cookies are small text files a site asks your browser to keep. localStorage and sessionStorage are browser storage areas that work like cookies but are not sent to our server with each request. A service worker is a script that lets a site cache pages so they load faster and work offline.
3. Cookies we set
All are set by Diduno's sign-in system (Auth.js) and are strictly necessary. You can browse Diduno as a guest without any of them, except where a sign-in flow has started.
| Cookie | Purpose | Lifetime |
|---|---|---|
authjs.session-token (__Secure-authjs.session-token on HTTPS) | Keeps you signed in. Holds a session identifier, not your personal data. | Up to 30 days, or until you sign out or delete your account |
authjs.csrf-token | Protects sign-in and sign-out forms against forged requests | Session |
authjs.callback-url | Remembers which page to return you to after sign-in | Session |
authjs.state, authjs.nonce, authjs.pkce.code_verifier | Short-lived values that secure the Microsoft sign-in handshake | Minutes, removed after sign-in |
Exact names can carry a __Secure- or __Host- prefix in production.
Diduno does not read or write cookies from its own page scripts (document.cookie is not used).
4. Browser storage (localStorage and sessionStorage)
This data stays on your device. We do not receive it unless stated.
| Key | Purpose |
|---|---|
diduno-nav | Remembers whether the side navigation is open or collapsed |
diduno-theme | Remembers light or dark theme |
diduno-campus | Remembers your selected campus |
diduno.favorites | Items you saved while not signed in (guests). Signed-in saves are stored in our database instead. |
diduno.calendar.view, diduno.calendar.span | Remembers list or calendar view and Month, Week or Year span |
diduno-analytics-off | Remembers that you turned analytics off at /privacy/choices. A Global Privacy Control signal is read from your browser each time and is not stored. |
diduno.resources.sourcesOpen, diduno.resources.hiddenSources | Remembers your Perks page source settings |
diduno-pending-home-campus, diduno-home-campus-asked (may include a user id suffix) | Remembers a home campus choice and whether we already asked |
| sessionStorage perk-track flag | Prevents counting the same perk click more than once per browser tab session |
The perk-track flag supports anonymous perk counters. Those counters contain no user, IP address or session identifier.
5. Service worker and cache (production only)
Diduno registers a service worker (/sw.js) on the live site. It stores copies of static files (scripts, styles, fonts, images) and of these public pages: /, /campus, /perks, /events, /forum, /help, /privacy, /terms and /offline. It never caches API responses or personal pages. Cached policy pages may be a little out of date until your browser refreshes them. The current version is always available online at the same address. Your browser's normal cache may also keep profile pictures it has loaded, privately, for up to a year.
6. Location (geolocation)
Diduno asks your browser for your location only when you use the place picker or the map locate control. Your browser shows its own permission prompt and you can refuse. Your position is not saved unless you post it as part of a find or forum post. Diduno's site settings allow geolocation for Diduno pages only.
7. Analytics and the choice you have
We use Vercel Web Analytics to count page views. Our code sets no cookie and stores nothing in your browser for it. According to Vercel's published documentation (vercel.com/docs/analytics/privacy-policy), the product does not use cookies to identify visitors: it identifies a visitor by a hash created from the incoming request, discards that visitor session after 24 hours, and records page views anonymously, not tied to an individual or IP address. Vercel Inc. processes request data to produce these counts.
You can turn analytics off at /privacy/choices. Diduno also reads the Global Privacy Control (GPC) signal (navigator.globalPrivacyControl). We treat a Global Privacy Control signal from your browser as a request to opt out of analytics. Your choice is saved in your browser's localStorage (diduno-analytics-off), so it applies to that browser only. Diduno does not sell or share personal information, so the signal changes nothing else.
8. Third-party requests that can see your IP address
These are not cookies, but loading them reveals your IP address to the provider:
- OpenFreeMap serves map tiles and style files directly to your browser. It can also see which Diduno page you came from.
- GroupMe serves chat images directly from
i.groupme.comwhen a chat shows an image. - Microsoft, when you choose to sign in.
Fonts are bundled with the site and are not loaded from Google at runtime.
9. How to control or delete storage
- Sign out to end your session. Deleting your account removes your sessions.
- Clear cookies and site data in your browser (Chrome, Safari, Firefox and Edge each have this under Privacy or Settings). Clearing localStorage resets your preferences and your guest saves.
- You can block cookies, but sign-in will not work without the cookies in section 3.
- You can unregister the service worker or clear its cache in your browser's site settings.
10. Changes and contact
We will update this policy when we add or remove cookies or storage and will change the effective date. If Diduno passes to a future company or other successor, this policy passes with it. Questions: [email protected]. Complaints and disputes about this policy are subject to the dispute provisions of the Terms of Service, which also protect every Diduno Party as the Terms define it. Diduno does not sell or share personal information and uses no targeted advertising.
Effective and last updated: November 9, 2026