Legal
Cookie Policy
Three cookies. All essential. None of them follow you around the internet. That is the whole policy, but the details are below.
Last updated September 1, 2026
1. The short version
Bluntpage Inc. uses only the cookies needed to sign you in and keep your session secure. We set no advertising cookies, no cross-site tracking cookies, and no third-party analytics cookies. If you never sign in, you can read the whole marketing site without any of the cookies below being needed.
2. What a cookie is
A cookie is a small text file a website stores in your browser so it can recognize the same browser on the next request. Ours are first-party cookies: they are set by bluntpage.com and only sent back to bluntpage.com.
3. The cookies we set
| Name | What it does | Set | Expires |
|---|---|---|---|
| authjs.session-token | Keeps you signed in. Holds an encrypted session token that identifies your account. Without it you would have to sign in on every page. | When you sign in | 30 days, renewed while you stay active. Removed when you sign out. |
| authjs.csrf-token | Security. Proves that sign-in and sign-out requests really came from our own pages, which blocks cross-site request forgery. | When you open a sign-in page or start a sign-in | End of the browser session |
| authjs.callback-url | Remembers which page to send you back to after you sign in, so you land where you were headed. | When you start a sign-in | End of the browser session |
On our secure production site, your browser may show these names with a __Secure- or __Host- prefix. The prefix is a browser security feature that guarantees the cookie is only sent over HTTPS. It is the same cookie. All three are marked HttpOnly, so scripts on the page cannot read them, and SameSite=Lax, so they are not sent along with requests from other sites.
These cookies come from Auth.js, the open source sign-in library we use. They are strictly necessary for a feature you asked for, which is being signed in.
4. What we do not set
- No advertising or retargeting cookies.
- No cross-site tracking cookies, tracking pixels, or social media trackers.
- No third-party analytics cookies.
- No fingerprinting as a workaround for any of the above.
5. Why there is no cookie banner
Consent banners exist to ask permission for cookies that are not strictly necessary, such as advertising and tracking cookies. We do not set any. Strictly necessary cookies do not require consent under the EU ePrivacy rules, the UK equivalent, or US state privacy laws, so there is nothing to ask you. If that ever changes, a consent choice will appear before any non-essential cookie is set, and this page will be updated first.
6. Third parties
If you choose Google sign-in, you briefly visit Google's own sign-in page, where Google may set its own cookies under its own policy. The same applies to Stripe's checkout page when you pay for a plan. Those cookies are set on their domains, not ours, and only when you choose to use those features.
7. Controlling cookies
You can block or delete cookies in your browser settings. If you block ours, the marketing site still works, but you will not be able to stay signed in to the app. Signing out removes the session cookie.
8. Changes and contact
If we change which cookies we set, we will update this page and the date at the top before the change goes live. For more on how we handle personal data, see the Privacy Policy and the Your data page.
Questions: privacy@bluntpage.com, or write to Bluntpage Inc., 1100 Peachtree Street NE, Suite 920, Atlanta, GA 30309, United States.