Cookie Policy

3.1 Essential (always on)

Required for authentication, CSRF protection during OAuth, and remembering your cookie choice. These do not require consent under the ePrivacy rules.

• next-auth.session-token (or __Secure-next-auth.session-token on HTTPS) — keeps you signed in. Duration: session / JWT lifetime.
• next-auth.csrf-token / next-auth.callback-url — sign-in security. Session.
• yt_oauth_state — YouTube OAuth CSRF protection. Short-lived; cleared after the callback.
• tt_oauth_state / tt_oauth_verifier — TikTok OAuth CSRF / PKCE. Short-lived.
• sv_consent — stores Accept / Reject / customized cookie preferences. Duration: up to 180 days.
• sidebar_state — dashboard sidebar open/closed. Duration: 7 days. Functional only.

3.2 Analytics (opt-in)

If you accept analytics, we load Google Tag Manager (container GTM-MV9RB3GM), which may set Google Analytics cookies (_ga, _gid, and similar) to measure page views and product usage. Provider: Google Ireland Ltd. / Google LLC. Duration: up to 2 years, depending on Google's configuration. These are not loaded if you reject non-essential cookies. If Google processes that data in the United States, the transfer relies on the EU-US Data Privacy Framework or Standard Contractual Clauses, as described in the Privacy Policy.

3.3 Marketing (opt-in)

Marketing cookies are not set unless you opt in and a tag is configured in Tag Manager. If you accept marketing, Tag Manager may load measurement or advertising tags from that container. No advertising tag is loaded from SimpleVids application code, including no Meta Pixel. A new marketing tag still requires this opt-in.