Legal

Cookie policy

A plain list of every cookie and browser storage entry this site sets, so you can see exactly what happens in your browser.

Last updated 31 October 2026

In short

SubmitRocket sets essential cookies only. They keep you signed in, protect forms, and remember choices you make yourself, such as the theme.

We run no analytics, no advertising and no social-media tracking cookies. No third-party script on this site sets cookies.

You can still tell us what you think. The cookie notice records Accept all or Reject all. Today the choice changes nothing you can see, because there is nothing optional to switch on. It is stored so that any optional cookie we add later is off unless you accept.

Your cookie choice

Accept all or Reject all. Both buttons are equal. Essential cookies are always on because the site needs them.

You have not chosen yet.

This control needs JavaScript. Without it nothing optional is ever loaded, and the essential cookies work as described above.

What cookies are

A cookie is a small text file your browser stores for a website. Some are needed for a feature to work, for example staying signed in. Others, which we do not use, measure visits or show advertising.

Browser storage (localStorage and sessionStorage) is similar but never travels to the server. We use it only for interface settings.

Cookies we set

Cookies set by SubmitRocket
Name	Purpose	Lifetime	Essential	Set when	Where
authjs.session-token	Keeps you signed in. It holds a signed token that identifies your account. It cannot be read by scripts on the page (httpOnly).	Up to 30 days, renewed while you use the site	Yes	When you sign in	Signed-in area
authjs.csrf-token	Protects the sign-in and sign-out forms against forged requests.	Until you close the browser (session cookie)	Yes	When you open a sign-in or sign-out form	Signed-in area
authjs.callback-url	Remembers which page to open after you sign in.	Until you close the browser (session cookie)	Yes	When you start signing in	Signed-in area
authjs.state, authjs.pkce.code_verifier, authjs.nonce	Short-lived security values for Continue with Google. They stop a sign-in from being hijacked in the middle.	15 minutes	Yes	Only while you sign in with Google	Signed-in area
so-theme	Remembers whether you chose the light, dark or system theme.	365 days	Yes	When you change the theme, or sign in with a saved theme preference	Whole site
so-announce	Remembers that you closed the announcement bar, so it does not come back on every page.	7 days	Yes	When you dismiss the announcement bar	Whole site
so-sidebar	Remembers whether you collapsed the dashboard sidebar, so the first paint has the right width.	365 days	Yes	When you collapse the dashboard sidebar	Dashboard
so-consent	Remembers your cookie choice (accept all or reject all) so we do not ask again on every visit.	180 days	Yes	When you choose in the cookie notice	Whole site
__prerender_bypass, __next_preview_data	Next.js Draft Mode. Lets an administrator preview unpublished content. Visitors never receive it.	Until you close the browser (session cookie)	Yes	When an administrator opens a content preview	Admin panel

authjs.session-token
Purpose
Keeps you signed in. It holds a signed token that identifies your account. It cannot be read by scripts on the page (httpOnly).
Lifetime
Up to 30 days, renewed while you use the site
Essential
Yes
Set when
When you sign in
Where
Signed-in area
authjs.csrf-token
Purpose
Protects the sign-in and sign-out forms against forged requests.
Lifetime
Until you close the browser (session cookie)
Essential
Yes
Set when
When you open a sign-in or sign-out form
Where
Signed-in area
authjs.callback-url
Purpose
Remembers which page to open after you sign in.
Lifetime
Until you close the browser (session cookie)
Essential
Yes
Set when
When you start signing in
Where
Signed-in area
authjs.state, authjs.pkce.code_verifier, authjs.nonce
Purpose
Short-lived security values for Continue with Google. They stop a sign-in from being hijacked in the middle.
Lifetime
15 minutes
Essential
Yes
Set when
Only while you sign in with Google
Where
Signed-in area
so-theme
Purpose
Remembers whether you chose the light, dark or system theme.
Lifetime
365 days
Essential
Yes
Set when
When you change the theme, or sign in with a saved theme preference
Where
Whole site
so-announce
Purpose
Remembers that you closed the announcement bar, so it does not come back on every page.
Lifetime
7 days
Essential
Yes
Set when
When you dismiss the announcement bar
Where
Whole site
so-sidebar
Purpose
Remembers whether you collapsed the dashboard sidebar, so the first paint has the right width.
Lifetime
365 days
Essential
Yes
Set when
When you collapse the dashboard sidebar
Where
Dashboard
so-consent
Purpose
Remembers your cookie choice (accept all or reject all) so we do not ask again on every visit.
Lifetime
180 days
Essential
Yes
Set when
When you choose in the cookie notice
Where
Whole site
__prerender_bypass, __next_preview_data
Purpose
Next.js Draft Mode. Lets an administrator preview unpublished content. Visitors never receive it.
Lifetime
Until you close the browser (session cookie)
Essential
Yes
Set when
When an administrator opens a content preview
Where
Admin panel

On https the sign-in cookies get a security prefix (for example __Secure- or __Host-). They are the same cookies.

Browser storage we use

so-sidebar
localStorage
Mirror of the collapsed dashboard sidebar choice, used when the cookie is missing.
Lifetime: Until you clear site data
so-submissions-view
localStorage
Remembers whether you view your submissions as a table or a board.
Lifetime: Until you clear site data
so-theme-synced:<account id>
sessionStorage
Marks that your saved theme was already applied after sign-in, so it is applied once per browser session.
Lifetime: Until you close the tab

Why we call these essential

Each cookie above is either needed to run something you asked for (signing in, protecting a form, paying) or stores a choice you made yourself (the theme, a closed announcement, a collapsed sidebar, your cookie choice). None of them identifies you across other websites and none is used for advertising or analytics.

Other websites you may visit from here

Some actions take you to another company's website, for example Continue with Google or the hosted crypto payment page. Those websites set their own cookies under their own policies. We do not control them, so read their notices before you continue.

Your choices

Use the box below, or the Cookie settings link in the footer of any public page, to change your choice at any time. Your choice is stored in the so-consent cookie for 180 days.

Your browser lets you block or delete cookies. If you block the essential ones, signing in and the forms will not work.

If this changes

If we ever add an optional cookie, such as privacy-friendly analytics, we will list it here first, ask again through the cookie notice and keep it switched off until you accept. Reject all will block it.

Questions

Write to [email protected] if you have a question about cookies or about your data. Our privacy policy has the full picture.

In short

Your cookie choice

What cookies are

Cookies we set

authjs.session-token

authjs.csrf-token

authjs.callback-url

authjs.state, authjs.pkce.code_verifier, authjs.nonce

so-theme

so-announce

so-sidebar

so-consent

__prerender_bypass, __next_preview_data