Privacy
If someone followed you offline, it’d be creepy.
Why isn’t it online?
Most cookie policies exist to explain all the ways a platform uses cookies. This one exists to explain the one way we do, and why it cannot be used against you. If you visit Saroir without signing in, no cookie is set at all.
The session cookie Saroir uses for authentication
Only when you sign in to Saroir, we create a session cookie. It is stored in your browser and contains a single value: a randomly generated session token that tells our servers you are authenticated.
That is everything it contains. No tracking identifiers. No device fingerprint. No advertising data. No behavioural signals. A random string that maps to your active session in our database, and nothing else.
This cookie is:
HttpOnly
It cannot be read by JavaScript running in your browser, including any script you or anyone else loads. It is invisible to the page.
Secure
It is only transmitted over HTTPS, never over plain HTTP.
SameSite: Strict
It is never sent to any domain other than saroir.com. No third party, no CDN, no analytics service receives it.
Session-scoped
It expires on the server after a fixed period of inactivity, or immediately when you sign out explicitly. Signing out permanently invalidates the token on our end. A copied or stolen token from a signed-out session is worthless because the server-side record it references no longer exists.
Why copying it does nothing
A session token is a key to a specific lock. The lock is in our database, and only exists while your session is active.
If someone copied your session cookie, they would have a random string. To use it they would need to send it to our servers within the active session window, from a context our server accepts. Sessions expire automatically. They are invalidated on sign-out. A copied token from an expired or signed-out session is permanently useless.
More precisely: the token has no meaning outside the Saroir authentication context. It does not encode your identity, your email, your DID, or any personal attribute. It is a reference to a server-side record that we control and you can destroy at any time by signing out.
What we do not use
No analytics cookies
No advertising cookies
No third-party tracking pixels
No third-party analytics services (no Google Analytics, no Meta Pixel, no equivalent)
No A/B testing cookies
No social media widgets that set cookies
No persistent identifiers of any kind beyond the single session token described above
If you visit Saroir without signing in, no cookie is set at all.
Anonymous usage analytics
To understand and improve how the platform works, we collect anonymous usage data including page visits, traffic sources, device types, and general location (country level). We may also record anonymised browsing sessions with all form inputs and personal information masked. No cookies are used for this, no IP addresses are stored, and this data is never linked to your identity or shared with any third party.
All analytics infrastructure is self-hosted on our own servers.
We do not use Google Analytics, Meta Pixel, Hotjar, Mixpanel, or any third-party analytics service. The analytics data never leaves infrastructure we control. There is no third-party JavaScript involved in data collection beyond the self-hosted script served from our own domain.
Verify this yourself
Open your browser's developer tools, navigate to the Application or Storage tab, and inspect the cookies set for saroir.com. You will find one entry while signed in, and zero entries while signed out.
You do not need to trust this page. The browser shows you everything.
Why we are telling you this in detail
Because Saroir is a platform built on the principle that trust should be provable, not just claimed. The same standard we apply to knowledge attribution (verify it, do not accept it on faith) applies to how we handle your data. This page exists so you know exactly what is set, why it exists, and why it cannot be used to track or identify you beyond the authentication function it serves.
From the founder's pen
I come from a marketing and technology background. I have spent years on the other side of this equation, understanding audiences, measuring behaviour, optimising for attention. And yes, at some point in that journey, I sat in a room where someone asked: how do we track the people who installed ad blockers?
That question stayed with me. Not because it was unusual. It was completely routine. It was the kind of problem marketing teams solve every day without a second thought. But it was also the clearest possible signal of something deeply wrong: the people who had explicitly said "please do not track me" were being treated as a technical obstacle to route around.
That is when I found Ghostery. The idea was simple, but it stayed with me: privacy is a right, not an option. In both the real world and the digital world, people should never be treated as products to be tracked, sold, or exploited.
When I started building Saroir, I knew that trust had to be the foundation, not a feature added later. And privacy is what seals trust. Not privacy as a legal checkbox. Not privacy as a marketing claim. Privacy as architecture. The kind where there is genuinely nothing to hide because the system was designed from the first line of code to collect only what it needs and nothing more.
So go ahead. Use Saroir. Contribute, discuss, collaborate, learn.
Nobody is watching. Nobody is building a profile. Nobody is routing around your choices.
That is not a promise. It is how we built this.