Fva Connect — Cookies and Data

The session cookie

When you sign in, Connect sets a cookie named fva_connect_session. It holds your session token, lasts 7 days, and is marked HttpOnly, Secure, and SameSite=Lax, so page scripts cannot read it. Signing out clears it, and revoking all sessions in your profile clears it too. Only the hashed form of the token is stored on the server.

The provider sign-in cookie

When you choose Continue with Google or Continue with GitHub, Connect sets a cookie named fva_connect_oauth_state. It holds a one-time check value for that sign-in attempt, lasts 10 minutes, and is marked HttpOnly, Secure, and SameSite=Lax. If the returned value does not match, provider sign-in fails closed and you are not signed in.

Your theme preference

Your light or dark theme choice is stored in your own browser, not in a Connect cookie. Clearing your browser storage resets it to the default.

What Connect does not set

Connect itself does not set advertising cookies and does not set tracking cookies for other sites. The human check, FVAVerify, does not use a Connect cookie: its pass is sent with the registration or sign-in request itself. The pages load a styling script from a content delivery network; that script is not a Connect cookie and Connect does not use it to track you.

Data Connect stores about you

Connect stores your name, email address, and hashed password; your profile details; your posts, comments, likes, connections, messages, and job posts, bookmarks, and applications; your sessions; and a record of admin checks under a Trace ID. Passwords are stored hashed, never in readable form. Provider sign-in tokens are not kept after sign-in.

Data Connect does not have

Connect has no account deletion route yet and no data download route yet, so this draft does not describe how deletion or download would work. [Fortune to confirm: whether deletion and download routes will be added, and how long posts, messages, and account records are kept.]

Signing out and clearing data

Signing out clears the session cookie. To end every session at once, revoke all sessions in your profile, then sign in again. Clearing cookies in your browser also ends the session on that browser.