Cookie Policy
Last updated: 2026-10-12 · Version 3
This policy explains cookies and similar device storage on LogiShell websites, the LogiShell store and clients. Operator details: LogiShell LTD, registered in England and Wales, company no. 17040399. Registered office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom. Contact: hello@logishell.com. See also our Privacy Policy and Terms of Service.
1. What these technologies do
Cookies are values a browser stores and sends with matching requests. Local storage persists on a particular site until removed; session storage normally lasts for a browser tab. IndexedDB and the cache storage of a service worker hold larger local data, such as drafts or copies of the app's own files so it can open offline. Installed clients (the desktop app and the installed web app) show the same pages and keep the same storage. Storage on one LogiShell site is not shared with another site.
2. Current use
Everything listed here is either necessary to deliver what you asked for (signing in, paying, working offline) or stores a choice you made yourself. None of it is used for advertising or to follow you across sites, so we do not ask you to "accept" it; we explain it.
2.1 Sign-in cookies (app.logishell.com)
Browsing logishell.com, the store, the legal pages or the app without signing in sets no cookie at all. Cookies appear only when you sign in:
| Cookie | Purpose | Duration and attributes |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in; set by our authentication service after a successful sign-in | 7 days from the last renewal, renewed while you use the service; HttpOnly, Secure, SameSite=Lax; removed when you sign out |
__Secure-better-auth.session_data | Signed short-lived copy of your session so that most requests do not need the database | 5 minutes; HttpOnly, Secure, SameSite=Lax |
__Secure-better-auth.state | Completes a sign-in with Google, GitHub or Apple and protects it against forgery | 5 minutes, during the sign-in only; HttpOnly, Secure, SameSite=Lax |
Your browser's storage inspector shows the actual cookies and their expiry. Identity providers you choose during sign-in have their own cookie policies on their own domains.
2.2 Cloudflare
Our pages are delivered by Cloudflare. In normal operation Cloudflare sets no cookie on LogiShell pages: we do not use Cloudflare Web Analytics or its beacon. If Cloudflare has to run a security challenge against suspected automated traffic, it may set cf_clearance or __cf_bm for the duration of that challenge; these are security cookies governed by Cloudflare's cookie notice. Where a public form is protected by Cloudflare Turnstile (the public company sign-up form), the Turnstile widget loads from challenges.cloudflare.com and keeps its state on that Cloudflare domain only while the check runs.
2.3 Browser storage (no cookies)
| Site | Key | Purpose | Duration and control |
|---|---|---|---|
| logishell.com | mdk.theme (local storage) | Remember the light or dark theme you chose | Until replaced or you clear site storage |
| logishell.com | lsh.booted (session storage) | Avoid replaying the opening animation within the same tab | Tab session |
| logishell.com | lsh.pwa.install.dismissed (local storage) | Remember that you dismissed the installation prompt | The dismissal is honoured for 14 days; the stored timestamp remains until replaced or cleared |
| logishell.com | lsh.landing.app-promo (local storage) | Remember that you skipped the "get the app" card shown on phones | Until replaced or you clear site storage |
| store.logishell.com | lsh.store.return (local storage) | Remember which card you clicked "add to LogiShell" on, so the install page can bring you back to it | Until replaced or you clear site storage; the store sets no cookies |
| app.logishell.com | Keys beginning lsh., lb. and mdk. (local and session storage) | Interface preferences (theme, accent, layout, open tabs and desks); the account and workspace you are in; local drafts and notes waiting to sync; and the addresses and credentials you enter yourself for your own machines and AI providers (for example your runner address and token, or an API key you paste). lb. is the product's former prefix and is kept so that an older build still finds its state. These values stay in your browser and are sent only to the service you addressed them to | Until replaced, evicted by the browser or removed through site storage controls; signing out does not clear them, clearing site data does |
| app.logishell.com | IndexedDB lsh.note-drafts, lsh.saved-links, lsh.block-index | Drafts, links saved while offline and the index of your local blocks | Until you clear site data |
| app.logishell.com | IndexedDB logishell-vault | A non-extractable device key for the wallet functions you use | Until you clear site data; clearing it means pairing the device again |
| app.logishell.com | Cache storage lb-shell-v4 (service worker) | Copies of the app's own files so it opens offline | Replaced on each release; cleared with site data |
2.4 Payment page (app.logishell.com/pay and the checkout window)
Paddle is the seller of record for plans and hosted servers. Its checkout script (cdn.paddle.com/paddle/v2/paddle.js) loads only when you open the payment page, that is, when you start a purchase; no other LogiShell page loads it. To run the checkout you asked for, Paddle sets cookies and storage of its own: it keeps the checkout session, determines your country for tax and prevents payment fraud. This storage is necessary for the purchase you initiated and is not used by us for any other purpose; it is governed by Paddle's cookie and privacy notices at paddle.com/legal. Clearing site data for the payment page removes it.
3. Optional measurement
No LogiShell site installs advertising or third-party analytics cookies, and none loads fonts, scripts or images from advertising or analytics networks. We therefore show no cookie banner: there is nothing optional to accept.
In the signed-in app, diagnostics and product analytics are separate optional choices in Settings → Privacy. They are account settings kept on our server, not device storage, and they are off until you turn them on, in every region. You can leave both off or withdraw either choice without losing core functionality. Our servers also count how many browsers reach a step and what shape an error takes, without any identifier and without device storage; the Privacy Policy, section 2, describes this. If we introduce non-essential device tracking, we must explain it and obtain the required prior choice before activating it; this policy is not advance consent.
4. Managing your choices
- For optional account telemetry, open LogiShell, then Settings → Privacy. You can switch either purpose off independently.
- Use your browser's privacy settings to inspect, delete or block cookies and site data for each LogiShell domain. Blocking necessary storage can prevent sign-in, checkout or offline functionality.
- Signing out and clearing site data serve different purposes. Clearing storage can remove local work, preferences and the credentials you entered; export anything you need first.
- Clearing a device does not withdraw a consent choice stored in your account. Update that choice in the app or contact hello@logishell.com if you cannot access it.
- We do not sell personal information or share it for targeted advertising, so there is no "Do Not Sell or Share" control to offer; US state residents have the rights described in the Privacy Policy, section 8.
Questions or requests: hello@logishell.com.