Cookies

Last updated: October 4, 2026

Not legal advice. This page describes browser storage and scripts this site is built to use. It is not a compliance statement, and it does not claim that any consent banner or certification is in place.

Cookies this site sets

Owner-panel cookie. Set by the site only after a supplied owner-panel secret matches the server secret. It is httpOnly, SameSite strict, path /, max age 8 hours, and secure in production. Ordinary visits do not set it.
Wallet library cookie storage.The wallet connection uses the wallet library's cookie storage and does not set a custom storage key in this site's code. The cookie name is the library default. This page does not invent that name.

The sign-in token is not stored in a cookie by application code. It is stored in browser local storage under the key alot.authToken.

Browser local storage

These keys are written by this site. They are not cookies.

alot.authToken: the sign-in token.
alot.userProfileCache.v1: a short-lived cache of display names.
alot.wallet.store.v2 and alot.wallet.verified.v1: public wallet state. An older key, alot.wallet.session.v1, is still read for migration.
alot-referred-by and alot-operator-ref-id: invite attribution in the browser.
alot.savedViews: saved pipeline views.
alot-operator-first-run-v2: first-run checklist state.
alot:legal:v7_0_ack: a lights warning acknowledgment kept in the browser. Older keys alot:legal:v6_ack, alot:legal:v5_ack, and alot:legal:v4_ack are only read.
alot-ad-impression-count: a count used to rotate on-site tips.
alot-wholesale-xp-v1 and alot-founder-badge-count: local scores kept in the browser.
alot-neon-arcade-assets-vibe and alot-neon-arcade-meta-tab-only: display preferences.

The owner secure page can also keep the owner-panel secret in session storage. Other screens write additional local storage keys for the features they show. Private keys and seed phrases are not stored by these helpers.

Scripts the site loads

Vercel Analytics and Speed Insights. The site loads both only when it is running on Vercel. Scripts are loaded from va.vercel-scripts.com. This site's code does not set a named analytics cookie for them. Whether those scripts set their own cookies is not defined in this site's code.
Sentry. Browser, server, and edge error reporting is set up in this site. The browser setup uses a Sentry address and includes session replay with text masked and media blocked. If that address is empty, this page does not claim that events are sent. This site's code does not name a Sentry cookie. Whether that address is set in production is a server setting, not something this page can see.
Cloudflare Turnstile. Signup, contact, and some other forms load the widget when a Turnstile site key is configured. The widget is served by Cloudflare. This site's code does not set a Turnstile cookie name. Whether Cloudflare sets one is not something this page can see.

Regrid

Parcel lookup runs on the API server against https://app.regrid.com/api/v2 when a server-side Regrid token is configured. If the token is unset, the server uses an offline adapter. The web app does not load a Regrid script in the browser, and this site does not set a Regrid cookie. Whether production currently has a Regrid token is a server setting. This page does not claim that live Regrid calls are on or off.

Unknown from this page

The content security policy allows script hosts for Google Tag Manager and Google Analytics. This site does not include a Google Analytics or Tag Manager snippet. Whether the host injects one is unknown here.
Cookies set by the browser, by Vercel, by Cloudflare, by a wallet extension, or by any script this page does not name, are not listed above.
There is no cookie-consent banner in this site's code.

Account and deletion requests are in the Privacy Policy. The contact address there is legal@a-lot.io, and the form is on Contact.