Cookie Policy
Last updated: 13 August 2026
ScholarGate uses a small number of cookies to sign you in, keep the service secure and remember your language choice. We do not use advertising, analytics or cross-site tracking cookies, so no cookie-consent banner is required for the cookies below. If we ever add optional cookies, we will ask for your consent first.
| Cookie | Purpose | Lifetime |
|---|---|---|
| authjs.session-token | Keeps you signed in after signing in with Google or with email and password (signed JWT, httpOnly). Strictly necessary. | 30 days, or until you sign out |
| authjs.csrf-token | Protects the sign-in flow against cross-site request forgery. Strictly necessary. | Browser session |
| authjs.callback-url | Remembers which page to return you to after sign-in. Strictly necessary. | Browser session |
| authjs.pkce.code_verifier | Verifies the Google sign-in handshake (PKCE). Strictly necessary. | 15 minutes, only during sign-in |
| sg_session | Keeps sessions from before the sign-in system changed signed in (HMAC-signed, httpOnly). New sign-ins use authjs.session-token. Strictly necessary. | Until it expires or you sign out |
| NEXT_LOCALE | Remembers the language you picked with the language switcher (English/Turkish). Set only when you change language. | 1 year |
Secure prefixes#
On the live site (HTTPS) the browser stores the authjs cookies under a __Secure- prefix, and the CSRF cookie under the stricter __Host- prefix. Same cookies, same purposes; the prefix only restricts them to encrypted connections.
Local storage (not a cookie)#
Your theme choice (light/dark) and recently-viewed methods are stored in your browser's local storage on your device. They are never sent to our servers.
Managing cookies#
You can clear or block cookies in your browser settings, but blocking the strictly-necessary cookies above will prevent sign-in from working.