Advertising cookies
The Lucion Identity source does not install advertising cookies or third-party advertising trackers.
COOKIES & STORAGE
Identity storage stays separated by purpose.
Lucion Identity does not persist identity, credentials, permissions, or recovery data in client storage. Authentication uses secure server-backed cookies and hash-only server session records.
Optional Google Analytics
Google Analytics loads only after you accept analytics. Page-view events contain a fixed site route; URL query strings and fragments are omitted so OAuth codes and state are not sent. Reject analytics to keep the tag disabled, or change your choice with Cookie settings. Google may receive the page route and standard browser request data when analytics is enabled.
Client-side persistence
This release stores only your analytics choice in browser storage. Identity, credentials, permissions, recovery material, and session tokens are not stored there.
Authentication sessions
Lucion Identity uses a Secure + HttpOnly __Host-lid_session cookie resolved only through its server-side SHA-256 token hash. A separate SameSite=Strict anti-CSRF cookie protects authenticated mutations and is not an authentication bearer credential.