Cookie Policy
Last updated: 18 October 2026
What we use
The application uses first-party cookies needed for portal authentication and security. It does not integrate analytics tools or advertising pixels. These necessary cookies do not require prior consent; “Understood” only dismisses the notice.
| Name / technology | Purpose | Duration |
|---|---|---|
| __Secure-next-auth.session-token | Maintain the authenticated session. May be split into cookies with numeric suffixes. | 8 hours, renewed when using the session; removed on sign-out. |
| __Host-next-auth.csrf-token | Protect authentication operations against forged requests. | Browser session. |
| __Secure-next-auth.callback-url | Return to the requested page after authentication. | Browser session. |
| cookie-notice-v1 (localStorage) | Remember that this information notice was dismissed. Does not provide consent to tracking. | 180 days; expiry is checked on the next visit. Can be removed in browser settings. |
Authentication cookies are managed by this website using NextAuth. In local environments without HTTPS, their names may omit the __Secure- and __Host- prefixes. Session data cannot be read by page JavaScript.
Manage browser storage
You can inspect, block or delete cookies and local storage in browser settings. Blocking necessary cookies may prevent sign-in and portal functionality. Dismissing the notice does not enable tracking. Any old “cookie-consent” local entry is not used to authorise tools and is removed when dismissing the new notice.
External services and changes
Hosting is provided by Vercel and photographs may be delivered by Cloudinary. These network requests may transmit technical data such as IP addresses; this is distinct from advertising cookies. External links, such as Instagram, open the service only when clicked. Any optional tools requiring consent introduced in future must remain blocked until you choose and allow you to withdraw that choice.
Privacy questions: info@mixedfeelings.pt.