Cookies
Last updated 5 September 2026
LineMerge sets only the cookies the service needs to work. There are no advertising cookies, no third-party tracking cookies, and analytics are cookieless, so there is no cookie banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-lm_at, __Host-lm_rt | Your sign-in session (access and refresh tokens). HttpOnly, Secure. | Session / up to 30 days |
__Host-lm_csrf | Protects forms against cross-site request forgery. | 12 hours |
__Host-lm_2fa, __Host-lm_retry | A sign-in waiting for its two-factor code, and a one-time marker while a session is renewed. | Minutes |
lm_tz | Remembers the timezone you chose on a booking page. | 30 days |
lm_lang | Remembers the language you chose on a booking page. | 180 days |
lm_ref | Remembers a referral link so both people get their free month if you sign up. | 30 days |
lm_oauth_*, lm_signin_next | One-time state while you connect a calendar or sign in with Google. | Minutes |
Cloudflare (cf_*, Turnstile) | Bot protection and network security on the booking form, when enabled. | Set by Cloudflare; see their policy |
| Stripe | Fraud prevention during checkout and in the billing portal, on Stripe's pages. | Set by Stripe; see their policy |
The __Host- prefix on the session, form-protection and two-factor cookies is the browser's guarantee that only LineMerge's own site can set them; local development builds use the same cookies without it.
Booking pages embedded on a host's own website (?embed=1) set the same first-party cookies inside the frame and nothing on the host's site. The mobile apps use no cookies; they hold a session token in the device keychain.
Questions: [email protected].