Cookies & local storage
This is the complete list. repoherald sets three cookies — one to keep you signed in, and two that remember display choices you made. We run no advertising cookies, no third-party analytics cookies, and nothing that follows you to other sites.
Cookies
| Name | Purpose | Lifetime |
|---|---|---|
authjs.session-token( __Secure- prefixed over HTTPS) | Keeps you signed in after GitHub sends you back. Without it every page would log you out. | Until you sign out or it expires |
rh_theme | Your light, dark, or coloured theme choice. A cookie rather than local storage so the server can render your theme in the very first byte of the page, instead of flashing the default and repainting. | 1 year |
rh_feed_layout | Remembers whether you chose the banner, tile, or hybrid feed layout. It is a cookie rather than local storage so the server can render your chosen layout immediately, instead of flashing the default first. | 1 year |
All three are exempt from consent prompts: the session cookie is strictly necessary, and the theme and layout cookies store only preferences you set yourself, at the moment you set them. None is used to identify or track you, and none is set before you act.
Local storage
These stay in your browser and are never sent to us. They remember choices you already made, so the interface does not forget them on every visit.
| Key | Purpose |
|---|---|
rh_sponsor_dismissed | Remembers you closed the sponsorship panel, so it stays closed |
rh_welcome_seen | Remembers you have seen the welcome guide |
rh_promo_seen | Remembers which discount codes you have already been shown |
rh_analytics_opt_out | Set only if you opt out of view counting below |
rh_theme_sync | Signals a theme change to your other open tabs so they update too |
Clearing your browser storage resets all of these. Nothing breaks.
How we count views without cookies
We measure how many people open a page or a repository, because listing authors want to know their work is being seen. We do it without identifying anyone.
Your IP address and browser user-agent are combined with a secret that changes every day and put through a one-way hash. Only that hash is stored — never your IP address. Because the secret rotates daily, the same visitor on two days produces two unrelated values, so the data cannot be used to build a profile or follow anyone over time.
This needs no cookie and no consent prompt. We are still giving you the switch, because being countable should be your call.
Opt out of view counting
Opting out stops your browser sending view events at all. It is stored in your browser, so set it again on other devices. We also honour your browser’s Global Privacy Control signal automatically.
Third parties
Pages that take payment hand you to Stripe, which sets its own cookies for fraud prevention — see Stripe’s privacy policy. Fonts are served from our own domain, so Google Fonts never sees your visit. See our privacy policy for the full list of processors.