Cookie policy
Fulcrum sets five cookies that exist to sign you in and keep that session safe. It sets a sixth, fulcrum_theme, only if you press the light/dark switch, to remember what you picked. There are no analytics, advertising, tracking or A/B-testing cookies — not disabled, not present.
Why there is no cookie banner
Consent is required for cookies that are not strictly necessary. Consent is not needed for the five sign-in cookies, because they are necessary to provide the service you asked for — you cannot sign in without them — and asking anyway would be a pretence: a banner offering a choice that does not exist. The sixth, fulcrum_theme, is not needed to sign in, which is why it is never set on its own: it appears only as the direct result of you pressing the theme switch, and a visitor who never touches the switch never receives it.
If analytics or any other non-essential cookie is ever added, that changes, and a real consent mechanism will be added with it.
The cookies
| Name | Purpose | Lifetime |
|---|---|---|
fulcrum_at | Proves you are signed in. Short-lived on purpose, so a copied session is useful only briefly. | 10 minutes |
fulcrum_rt | Renews the above without making you sign in again. Sent only to the sign-in endpoints, not with every request. Rotates on each use, and re-use of an old one ends every session in that family. | 7 days |
fulcrum_mfa | Holds the gap between entering your password and entering your two-factor code. On its own it cannot sign you in. | 5 minutes |
fulcrum_reauth | Records that an administrator has just re-confirmed their password and two-factor code before a destructive action. | 5 minutes |
fulcrum_csrf | Stops another website from making requests as you. This is the one cookie readable by JavaScript on this site, because the page has to echo its value back — it grants no access by itself. | 7 days |
fulcrum_theme | Remembers whether you chose the light or the dark theme. Set only when you press the theme switch. It contains the single word light or dark. Readable by JavaScript, because the switch writes it. | 1 year |
All six are restricted to this site only and are never sent to another domain. Four of the six cannot be read by JavaScript at all. When this site is served over HTTPS, all are marked so the browser will only send them over an encrypted connection.
What happens when you sign out
Signing out deletes fulcrum_at, fulcrum_rt, fulcrum_mfa and fulcrum_reauth, and revokes the session on the server so the refresh token cannot be used again even if it were copied beforehand.
fulcrum_csrf is not deleted when you sign out and may remain in your browser for up to 7 days. It contains a random value, is tied to no account, and grants no access on its own — but it is still there, and saying “signing out removes all cookies” would not have been true. You can clear it through your browser at any time. fulcrum_theme is not deleted either: it is a display preference, tied to no account, and it stays for up to a year or until you clear it in your browser or press the switch again.
Other storage
Fulcrum does not use local storage, session storage, IndexedDB or browser fingerprinting. No authentication token is ever written anywhere JavaScript can read it, which is why the cookies above do the work instead.
Blocking cookies
You can block these cookies in your browser. You will not be able to sign in — there is no other mechanism for keeping you signed in, and no fallback that would work. The public pages, including this one, will still be readable.
For what is stored on our side rather than in your browser, see the privacy policy.