Cookies & Browser Storage
Effective date: August 10, 2026
Last updated: August 10, 2026
Markup's use of cookies and browser storage is small enough to list exhaustively, so this page does exactly that. There are three surfaces, and they behave differently.
These public pages
The marketing, documentation and legal pages — including the one you are reading — set no cookies and load no analytics or third-party scripts. There is nothing to consent to here, which is why you didn't see a banner.
The dashboard
The signed-in dashboard (everything under /workspaces, /projects,
/account, /notifications, /invite, /login and /oauth) uses:
| What | Kind | Purpose | Lifetime |
|---|---|---|---|
markup.* session cookies | First-party cookies (HttpOnly) | Keeping you signed in after Google authentication | Your session; refreshed while you use the app |
ph_* analytics identifier | First-party cookie + localStorage | Product analytics (PostHog EU) — which features get used | Until cleared or you delete your account |
px.isLogging | localStorage | Remembering that a sign-in redirect is in flight | Removed when sign-in completes or is abandoned |
Notes on the analytics identifier: it exists only inside the signed-in product, events are keyed to your account (which you already identified by signing in), URLs are masked to route patterns before leaving your browser, and session recording and autocapture are off. Details are in the Privacy Policy. If your browser or an extension blocks it, the dashboard works identically.
The widget, on sites that installed Markup
The widget stores just enough in your browser to remember that you are the same commenter you were yesterday — scoped to that one site. Nothing it stores follows you to any other site, which is why the same browser on two Markup-equipped sites is two unrelated commenters.
| What | Kind | Purpose | Lifetime |
|---|---|---|---|
markup.identity | localStorage on the host site, or Partitioned HttpOnly cookies | Your commenter id and the signed token that proves it; your sign-in session if you verified | Until erased — see below; sign-in tokens expire in 15 minutes and refresh for up to 7 days |
markup:widget:theme | localStorage on the host site | Your dark/light preference for the widget | Until cleared |
| Toolbar preferences | localStorage on the host site | Where you docked the toolbar | Until cleared |
Which mode applies — localStorage or partitioned cookies — depends on
how the site integrated the widget and what your browser supports. In
the cookie mode, cookies carry the Partitioned attribute, meaning
they are double-keyed to the host site and technically unusable for
cross-site tracking.
All of this storage exists solely so the widget can function — holding your identity on that site and your display preferences. The widget sets no advertising, measurement, or tracking identifiers of any kind, and its product telemetry (which the site owner can disable) involves no browser storage at all and no personal identifier.
Removing it
- Widget: the widget menu's Privacy & data panel has a Forget me on this site action that erases your comments on that site and clears the identity held for you. Clearing the site's data in your browser removes the storage, too.
- Dashboard: signing out ends your session; deleting your account (Account page) removes it and resets the analytics profile. Browser controls — clearing site data for the dashboard domain — remove everything listed above.
Changes
If the service ever needs a cookie or storage entry not listed here, this page changes first, in the open — its history is public. Questions: hello@pixelmatters.com.