XorChat cookies and browser storage

Last revised: October 1, 2026.

Account session

The application uses a session cookie to keep your account signed in and protect account actions. It also uses request-verification tokens to help prevent unauthorized form submissions. These controls are necessary for account functions; blocking cookies can prevent sign-in.

Conversation state

The messaging interface uses this tab's session storage for recent message and nudge markers (xorchat-msg and xorchat-nudge). These reduce repeated alerts. Session storage is separate from server-stored conversation history. Clearing browser storage does not delete the messages or account stored by XorChat.

Permissions and language

Desktop notifications require browser permission. Audio/video features require browser microphone or camera permission when used. Change these permissions in your browser's site settings. Optional translated pages may open an external translation service; review that service's privacy information before using it.

Encryption and recovery state

The encrypted-conversation interface may use browser storage to remember device setup or whether a recovery-key export has been recorded on that browser. This browser-side state does not give XORVANIQ a universal plaintext key for new Encrypted Conversations, and clearing local browser storage can affect device setup or recovery information without deleting server-held account records.

Security and abuse prevention

Session identifiers, CSRF/request-verification values, rate-limit state, and similar technical controls may be used to authenticate requests, reduce repeated abuse, and protect accounts. Infrastructure logs can also contain network and request metadata as described in the Privacy Policy. These controls are separate from advertising cookies.

Third-party features

When you deliberately open a third-party service, payment flow, translation service, or external link, that provider may use its own cookies or browser storage. XorChat does not control storage set on another provider's site. Review the destination provider's privacy information before using optional external features.

Your choices

Manage notification preferences in Account & privacy and in your browser. Sign out on shared devices. Use the account export or deletion controls for server-held account data. For privacy questions contact privacy@xorvaniq.ca.