Cookies
Cookie policy
Last updated: August 24, 2026
This page is short because the list is short. Thirdlight uses cookies to run your session and keep you signed in — not to track you.
In plain words
- One essential cookie connects your browser to your in-progress session. It expires after 24 hours.
- When accounts are on, our sign-in provider sets the cookies that keep you signed in.
- Our analytics set no cookies and store nothing on your device.
- We run ads, so we set one advertising cookie that tells us which ad brought you here. We do not ask first, and you can clear or block it in your browser at any time.
The summary above is a guide. The full text below is the part that governs.
1. The cookies we set
| Cookie | Type | Lifetime | What it does |
|---|---|---|---|
mend_visitor | Essential | 24 hours | Set when you begin a session. A random identifier that connects your browser to your in-progress session and snapshot before an account exists. Readable only by our server, never by scripts. |
| Sign-in cookies (Clerk) | Essential | While you stay signed in | Set by Clerk, our sign-in provider, when you create an account or sign in. They are what keeps you signed in between visits. |
| Payment cookies (Stripe) | Essential — arrives with paid subscriptions | Set during checkout | When subscriptions open, Stripe sets cookies on its checkout surfaces for payment security and fraud prevention. |
_gcl_au | Advertising — not essential | 90 days | Set by Google on your first page view. It records that you arrived from one of our ads, so we can tell which ads bring people here. It carries nothing about what you say in a session. Not set for visitors in the EEA, the UK or Switzerland. |
Everything above the last row exists to provide something you asked for. The last row does not — it is there because we buy ads and need to know which ones work. We do not put a consent banner in front of you for it. Section 4 says how to refuse it, and we do not advertise in the places where the law requires us to ask first: for visitors in the European Economic Area, the United Kingdom and Switzerland, the Google tag runs with advertising storage switched off, so that last row is not set at all.
2. Analytics, without cookies
We count product steps in aggregate — a session started, an invite accepted — and we configured that counting to store nothing on your device: no cookies, no local storage, no identifier that survives between visits. Each visit looks new to our analytics, and no event ever contains anything you said or typed. The privacy policy describes exactly what an event carries.
3. What is not here
- Nothing about your session is shared with an ad network. A conversion tells Google that somebody who clicked an ad reached a step — an account created, a session started — and nothing else. No name, no topic, and no word of what was said.
- No session-replay or screen-recording scripts.
- No identifier of ours follows you to another site. The advertising cookie is first-party — readable only here — but we should be straight about the other half: because the tag runs with ad personalisation on, Google can associate your visit with its own advertising profile of you, which is what makes remarketing possible. Section 4 is how you switch that off.
4. Controlling cookies
Your browser can block or clear cookies for any site, including ours. If you block the essential ones, the product loses its short-term memory of you: a session in progress cannot find its snapshot, and sign-in will not hold. Everything else about the site still works.
The advertising cookie is the one you can refuse with nothing lost. We do not put a banner in front of you asking about it, so here are the controls that actually work:
- Block or clear
_gcl_aufor thirdlight.app in your browser’s cookie settings. Nothing about the product changes. - Turn off personalised advertising across Google at My Ad Center. That covers this site and every other one using Google’s ad products.
- Browser-level tracking protection, or an ad blocker, stops the Google tag from loading here at all.
If you are in the European Economic Area, the United Kingdom or Switzerland, you do not need to do anything: the tag already runs with advertising storage off for you, and the cookie is not set.
5. Changes
If this list ever grows, we update this page and the date at the top. We would rather change this page than leave a sentence on it that has stopped being true.