Cookies and similar technologies
Last updated: 6 October 2026
This page covers everything Nichiyomu stores on your device - cookies, but also browser storage such as localStorage, which the ePrivacy rules treat the same way. It complements our Privacy Policy.
Most of what we store needs no permission. One category does. Under the ePrivacy rules, consent is needed to store or read information on your device unless that storage is strictly necessary for a service you asked for. Keeping you signed in, protecting the forms against bots, and remembering the preferences you set yourself all fall inside that exemption, and our analytics are deliberately cookieless. Advertising cookies do not fall inside it - so they stay off until you switch them on in the cookie banner, and you can change your mind at any time.
That is a narrower statement than "we collect nothing", and we would rather be precise than flattering. Not needing consent for device storage does not mean that no personal data is processed at all - our analytics still process your IP address in passing, on a different legal basis, and you can object to that. The Privacy Policy sets out everything we process and why.
What we store
Strictly necessary
Required for the Service to work. You cannot opt out of these, but you can clear them by signing out.
| Name | Purpose | Duration |
|---|---|---|
| sb-<project>-auth-token (may be split into .0, .1) | Keeps you signed in. Set by Supabase, our authentication provider. Split across numbered cookies when the token exceeds the browser size limit. | Until sign-out; refresh token up to 30 days |
| cf_chl_* | Set by Cloudflare Turnstile when the anti-bot check runs on the sign-up, sign-in and password-reset forms, to verify you are not a bot. | Session / short-lived |
| CookieConsent | Records the cookie choice you made in the banner, so that we do not ask again and can show your choice was respected. Set by Cookiebot, our consent manager. Refusing it is not possible, because it is what remembers a refusal. | 12 months |
| email_link | Holds the one-time code from a confirmation or password-reset email between opening the link and pressing the confirm button, so the code never appears in the page address. Set by us, deleted once the button is pressed. | Up to 1 hour |
Your preferences (browser storage)
Stored locally in your browser so the app looks and behaves the way you left it. These never leave your device.
- theme - light or dark mode (localStorage, until you clear it)
- nichiyomu:audio-volume - audio playback volume (localStorage, until you clear it)
Security and anti-abuse
We use Cloudflare Turnstile on the sign-up, sign-in and password-reset forms to block automated abuse. It loads a script from Cloudflare and may store a short-lived challenge token on your device. Cloudflare receives your IP address and browser signals to make that assessment. Turnstile does not use cookies to track you across sites and is not used for advertising. See Cloudflare's privacy policy.
Analytics
We use Umami to see how the site is used - which pages get visited, which features people open, and roughly where visitors arrive from. Umami sets no cookies and stores nothing on your device, so the consent requirement in Art 5(3) of the ePrivacy Directive does not apply: that rule governs storing or reading information on your device, and we do neither.
Cookieless is not the same as data-free. To tell a new visit from a continuing one, and to work out an approximate country, our analytics briefly process your IP address and browser user agent. Those are turned into a short value that changes every day and cannot be reversed back into your address; the IP address itself is not stored, nothing is written to your device, and none of it is joined to your account or your reading history. Because this is still processing of personal data, we rely on our legitimate interest in understanding how the Service is used (Art 6(1)(f) GDPR) rather than on consent - which means you have the right to object to it at any time, as described in our Privacy Policy. Our analytics are never used for advertising and cannot follow you to other websites. That is a statement about Umami specifically - the advertising cookies described below are a separate category, and a separate choice that is yours to make.
Advertising - only if you accept
We advertise Nichiyomu on Google and Meta (Facebook and Instagram). If you accept advertising cookies, their tags record that one of our ads led to a visit and whether you then signed up, so we can tell which advertising is worth paying for. These are the only items on this page that require your consent, and nothing below is placed on your device until you give it.
Being straightforward about what this means: Google and Meta do not use this only on our behalf. They can link it to an account you already hold with them, recognise you on other websites, and use it to personalise the advertising you see elsewhere. That is why it is a separate choice rather than something bundled into the rest.
What they do not receive is your reading. Which texts you open, how you rate them, your reading level and your streak stay in your account and are never sent to an advertising platform. The tags report a page view on our public pages, and a conversion at the moment you complete a sign-up or start a subscription. To be exact rather than flattering: once loaded, the tag scripts stay loaded as you move around the app, so Google and Meta can see that you opened Nichiyomu - but they report nothing at all from the reading pages. No page views, no text, no ratings, no level.
| Name | Purpose | Duration |
|---|---|---|
| _gcl_au | Set by Google to attribute a sign-up to an advertisement you clicked. | 90 days |
| _fbp | Set by Meta for the same purpose, and to recognise your browser across sites that use its pixel. | 90 days |
Google and Meta set further cookies on their own domains when you are signed in to their services; those are governed by Google's and Meta's own policies, not ours. Our Privacy Policy explains the legal basis, the transfers involved, and the joint-controller arrangement with Meta.
Payments
Polar, our Merchant of Record, may set its own cookies during checkout and payment. That happens on Polar's hosted checkout, under its own policy - see Polar's privacy policy.
Managing what is stored
Advertising cookies are yours to switch on or off at any time, and withdrawing is as easy as accepting.
- reopens the consent banner. Your existing choice stays in force until you change it there.
You can clear or block cookies and site data through your browser settings. Blocking strictly necessary items will stop you from signing in. Clearing browser storage resets your theme and volume preferences to their defaults. For general guidance, visit allaboutcookies.org.