Browser storage
This notice explains cookies and equivalent browser storage used by St. Nick's List. It should be read with the Privacy Policy.
Notice version: September 16, 2026
Session, CSRF, recent-verification, invitation-exchange, guest-management, giver-session, and first-party referral storage keeps signed-in and private-link journeys secure and preserves a requested referral for up to 30 days. Disabling it prevents those features from working.
The first-party NEXT_LOCALE cookie stores your language (en-CA or fr-CA). It is set only when you choose a language or open a French page, is kept for 12 months, and is not used for tracking.
Theme and consent choices are stored on the device so the site can remember how you asked it to behave. These values are not advertising profiles.
PostHog counts page views for every visitor without a cookie, local storage, or any identifier kept on the device. Each page load is counted on its own, so visits cannot be linked to each other or to a person, and signed-in people are never identified. Because nothing is stored on the device, no consent is asked for.
Only when you grant analytics consent: PostHog receives named product events (such as a list created or an account set up) with no names, emails, list contents, or identifiers, and Google Analytics 4 loads and sets its first-party _ga cookies (kept up to two years) to measure visits and usage. Google Analytics runs in Consent Mode with advertising storage, ad personalization, and Google signals off. Automatic click capture and session recording are disabled. Withdrawing consent stops both and removes the Google Analytics cookies this site set.
You can reopen the consent controls at any time. Withdrawing analytics consent stops product events and Google Analytics on this device and removes the Google Analytics cookies. Cookieless page counting continues because it stores nothing.
Security cookies last only as long as the related session, invitation, verification proof, or documented maximum. Revocation, sign-out, expiry, or account deletion invalidates the corresponding server-side authority even if a browser retains an old value.
A referral visit stores an opaque, HTTP-only, same-site token for no more than 30 days. It is used only to record privacy-limited first-party attribution, is removed after an eligible account conversion, and is not available to client-side scripts.
Browser settings can remove local storage. Removing essential values may sign you out or require a private invitation to be exchanged again.