What cookies are
A cookie is a small piece of text a website asks your browser to store and send back on later visits. Cookies can remember a sign-in, or they can follow you across the web. We only use the first kind. Some preferences below live in localStorage instead — those never leave your browser at all, and we list them anyway, because the point of this page is the whole inventory, not a narrow legal reading.
What we set
xr_session — a cookie, HttpOnly, Secure, SameSite=Lax. Essential. Set only after you sign in to the Business web dashboard; it keeps you signed in and binds the session to your account. It contains no tracking identifier and is deleted on sign-out or expiry.
__stripe_* — cookies set by Stripe, on checkout pages only. They are part of payment processing (fraud prevention and remembering where you were in the checkout). We never see their values and do not set them ourselves.
xr_cookie_ack — localStorage, not a cookie. Remembers that you dismissed the cookie banner at the bottom of this site, so it does not return on every page. It holds the single value “1”.
Interface preferences — localStorage, not cookies. Theme, density, and sidebar choices, where you set them, so the interface looks the way you left it. Nothing about them leaves the device.
What we do not use
We do not use analytics cookies, advertising cookies, third-party tracking cookies, or session-replay tools. There is no Google Analytics, no Tag Manager, no Hotjar, no FullStory, no PostHog on this site or in the app. The privacy policy explains the wider rule: XR Personal collects nothing, and Business collects only what billing, accounts, and team sync need.
Controlling cookies
Your browser lets you block or delete cookies and localStorage at any time (Settings → Privacy in every major browser). Deleting them signs you out and resets interface preferences — nothing else; your XR data lives on your machine or in your Business account, not in cookies. Blocking the essential cookies above will prevent sign-in and checkout from working, which is precisely what they are for.