Cookie Policy
EFFECTIVE October 5, 2026
1. What this policy covers
This policy explains how LewdByte uses cookies and similar browser storage on the LewdByte website and account service. For questions, contact [email protected].
When enabled on login and signup, Cloudflare Turnstile may use cookies or browser storage that are strictly necessary to deliver its bot-protection challenge and prevent abuse. They are governed by Cloudflare's security and privacy terms and are not used by LewdByte for advertising.
2. Strictly necessary cookies
We use only cookies needed to operate and protect the service:
- lewdbyte_access keeps an authenticated session active for up to 15 minutes.
- lewdbyte_refresh securely renews an authenticated session for up to 7 days.
- lewdbyte_mfa_challenge completes a two-factor sign-in and expires after 5 minutes.
- lewdbyte_csrf protects account requests from cross-site request forgery and expires after 24 hours.
- lewdbyte_locale remembers the language and region you select for up to one year. It is used only to display the site in your preferred language.
Authentication values are encrypted before storage. Authentication cookies are inaccessible to browser scripts, and production cookies use secure transport and SameSite restrictions. The CSRF cookie must be readable by our own site so its signed value can be echoed in a protected request header.
3. Local website preferences
When you dismiss our cookie notice, the site saveslewdbyte-cookie-notice:v1 in local browser storage. When you confirm that you meet the minimum age requirement, it saves the first-partylewdbyte_age_verified cookie for up to 30 days. Reading that cookie on the server prevents the age check from flashing during page reloads. These preferences do not identify you, follow you between websites, or leave your browser.
4. No advertising or cross-site tracking
We do not use advertising cookies, third-party analytics cookies, fingerprinting, or cross-site tracking pixels. We do not sell cookie data or use it to build advertising profiles.
We use a self-hosted Umami tracker for anonymous first-party traffic, UTM campaign, conversion-event, and website-performance measurement. It does not set analytics cookies or create an identity that follows you to another website. Session replay and heatmaps are disabled, and arbitrary URL query parameters are removed before collection.
5. Your controls
You can remove cookies and local storage using your browser settings. Removing authentication cookies signs you out, disabling necessary cookies can prevent account features from working, removing the age-confirmation cookie makes the age check appear again, and clearing local storage restores the cookie notice. Because these cookies are strictly necessary, the site does not present an advertising consent toggle.
6. Changes
We may update this policy when our authentication, security, or storage practices change. The effective date above identifies the current version.