Policies
Cookie Policy
Last updated November 9, 2026 · Markdown
We keep this short, because our use of cookies is short.
Lexicon Garden uses cookies for one job: signing you in, and keeping that sign-in safe from other websites. They're all first-party and strictly necessary, and none is used for ads, analytics, or tracking, which is why there's no cookie banner. You can browse, search, and validate lexicons without any of them. This policies site sets no cookies at all.
1. We use cookies for one job: signing in
Lexicon Garden, at lexicon.garden, sets these cookies when you sign in or use a form. They're sent only back to lexicon.garden, over encrypted connections.
| Cookie | What it does | How long |
|---|---|---|
session | Keeps you signed in. It's encrypted and holds your DID, handle, PDS address, and the tokens Lexicon Garden uses with your account. Page scripts can't read it. | 28 days, or until you sign out |
identity | Lets the page show who you're signed in as: your DID, handle, and PDS address. | 28 days, or until you sign out |
pending_session | Holds your place while you accept these policies, between your provider and your first session. | 30 minutes |
oauth_state | Ties a sign-in to the browser that started it, so another site can't finish it. | 10 minutes |
csrf_token | Protects forms and actions against forged requests from other websites. | 24 hours |
The session cookie's 28 days are enforced on our side too: an older copy stops working even if a browser keeps it.
This policies site, policies.lexicon.garden, sets no cookies.
2. What your browser remembers
Some pages keep small things in your browser's own storage. They stay on your device and aren't sent to us:
- your theme choice, light or dark, if you pick one (
lg-theme); - the lexicon builder's workspace, while you sign in to publish it, so it's there when you come back; and
- lexicons sent from the builder to the validator, until the validator reads them.
The last two are kept for the browser tab only and are gone when you close it.
3. What we don't use
We don't use:
- performance or analytics cookies,
- advertising or tracking cookies, or
- third-party cookies of any kind.
4. Why there's no cookie banner
Our cookies are strictly necessary to provide the service you asked for: signing in and keeping that sign-in safe. Under EU law (Article 5(3) of the ePrivacy Directive, as implemented in each member state) and UK law (regulation 6(4) of the Privacy and Electronic Communications Regulations), strictly necessary cookies don't require consent, and a consent banner for cookies like these would suggest you have a choice to make when you don't.
The law still requires us to tell you about these cookies, which is what this page does.
5. Turning cookies off
You can block or delete cookies in your browser's settings. If you do, you won't be able to sign in from that browser, but browsing, searching, and validating lexicons keep working.
6. Changes to this policy
We may update this policy. A change is a new version of this site, and you'll be asked to accept it the next time you sign in. When we make a major change, we'll announce it from @lexicon.garden on Bluesky at least 30 days before it takes effect, unless the law or an urgent safety or security problem requires a faster change. If we ever want to use cookies for anything other than signing in, we'll update this policy first.