XipID cookie policy

Effective November 9, 2026.

Who we are

XipID is owned by XipHub Inc. and operated by Bryllyant Inc. ("Bryllyant", "we"). This policy names the cookies set when you use this site, xipid.org, or the pages at app.xipid.org: what each is for, how long it lasts and who sets it. The privacy policy says what XipID collects and what it does with it.

What a cookie is

A cookie is a small piece of text that a website asks your browser to keep and to send back on later visits. XipID needs some of its cookies to work. The others measure how XipID's pages are used, and you can turn those off.

The cookies XipID needs

XipID's own servers set these, and no script on a page can read them. A name that begins with __Secure- is one your browser accepts only from a secure connection and sends only over one.

• Your sign-in. __Secure-xipid.session_token keeps you signed in to XipID in that browser. It lasts up to seven days after you last use XipID, and using XipID renews it at most once a day.
• A copy of your session. __Secure-xipid.session_data holds a copy of your session for five minutes, so XipID need not look it up each time.
• A request's page. xipid_page is what XipID trades a request's link for when you open it from a text, so the request's page keeps working in that browser, even when you reload it, without the link being used again. Only the request's page uses it, and it ends thirty minutes after the request expires.

For XipID's staff

A member of XipID's staff gets one more cookie from XipID's servers for each of these steps, and nobody else gets them:

• __Secure-xipid.two_factor, for ten minutes, while they sign in with the code from their authenticator app;
• __Secure-xipid.passkey, for five minutes, while they register a passkey or sign in with one;
• __Secure-xipid.staff_enrollment, for fifteen minutes, while they enroll the device they sign in with.

The cookies that measure how XipID is used

Google Analytics and PostHog set these on this site and at app.xipid.org. The privacy policy says what they record, what never reaches them, and what Google does with what it measures.

• Google Analytics. _ga tells your browser apart from others, and _ga_<id> keeps each visit's pages together. They last two years from your last visit, as Google sets them by default.
• PostHog. ph_<key>_posthog does both for PostHog. It is set for xipid.org and every address under it, so one cookie serves this site and app.xipid.org, and it lasts a year from your last visit, as PostHog sets it by default.
• Your choice. xipid_no_analytics remembers that you turned analytics off. It is set for xipid.org and every address under it, and it lasts a year from your last visit.

Turning analytics off

The button "Turn off analytics", at the foot of every page, turns Google Analytics and PostHog off in that browser, here and at app.xipid.org, and xipid_no_analytics keeps that choice for a year from your last visit. Your browser's own settings can also block or delete cookies. Blocking XipID's own cookies signs you out and stops a request's page from working.

What your browser keeps besides cookies

PostHog keeps most of what it needs in your browser's local storage, under the same name as its cookie, ph_<key>_posthog, once for this site and once for app.xipid.org. Local storage has no end date of its own: it stays until your browser's data for the site is cleared.

The pages at app.xipid.org also keep a little in your browser tab's own storage, such as the version of the page the tab last loaded. On this site and at app.xipid.org, PostHog keeps two entries there as well, which tell one tab from another: ph_<key>_window_id and ph_<key>_primary_window_exists. The tab forgets all of them when it closes.

Changes

When this policy changes, the new version is published here with its effective date.

Contact

Bryllyant Inc., help@xipid.org.