---
title: Do We Store Cookies? 🍪
slug: do-we-store-cookies
docTags: 
createdAt: 2025-03-25T21:33:26.632Z
---

With how strict the EU has become around privacy and cookies here’s a breakdown based on **EU ePrivacy Directive** (aka the "Cookie Law") and **GDPR**:

### 1. \_\_cf\_bm (Cloudflare bot protection cookie)

- **Type**: *Strictly necessary*
- **Legal status**: ✅ **Allowed without consent**
- **Why**: It’s used purely for **security (bot detection, DDoS protection)** — not for tracking or advertising.
- **Notes**: You **do not need a cookie banner or explicit user consent** for this one, but you **must disclose it** in your privacy/cookie policy.

### 2. connect.sid (Session cookie)

- **Type**: *Strictly necessary (when used only for login/session)*
- **Legal status**: ✅ **Allowed without consent**, as the law allows for:
  - It’s use when used to **maintain logged-in sessions**
  - It's use when it doesn’t track users across sites or store extra identifiable info
- **Why**: Functional cookies like this are **essential for the service to work** (e.g., logging in, staying authenticated).
- **Does it store personal or tracking data?**
  - ❌ **No.** This cookie only stores a session ID — **not user data, PII, or tracking behavior**. 
    - The actual user session data is stored server-side (e.g., in memory, Redis, or a DB), not in the cookie itself.

### TL;DR: Cookie Summary Table

| Cookie      | Consent Required? | Legal if...                                 |
| ----------- | ----------------- | ------------------------------------------- |
| \_\_cf\_bm  | ❌ No              | Used for security, bot management only      |
| connect.sid | ❌ No              | Used strictly for login/session maintenance |

#

***

# Summary

### Extra Precautions You Can Take | Optional

- ✅ Keep a clear **cookie/privacy policy** that mentions both cookies.
- ✅ You can mention to users that the service uses **Cloudflare** for protection and sessions for login.

### What We Will Always Do

- ✅ **We will always adhere to international laws to stay ISO27001 compliant and safe under EU rules.** At the moment we only have a token for session handling, but if that were to change we would enforce the use of a Cookie Consent form.