Cookies and local storage
What storage technologies JustMess uses and how to control them.
Edition of 2026-09-09
We use cookies and device storage (localStorage, IndexedDB, app cache) to make the Service work. We do not use third-party advertising cookies or trackers.
1. What we store
- Strictly necessary: the refresh-token cookie (httpOnly) and the access token — signing in is impossible without them; they cannot be disabled.
- Preferences: chosen language, theme, font size, interface state.
- Feed city: the “where I am browsing swaps” value chosen in the header is kept on the device only and is never sent to the server — it means “where I am looking right now”, not “where I am from” (the latter lives in your profile).
- Offline data: a local copy of recent chats and drafts in IndexedDB so the app opens instantly and works without a connection.
- Security: technical values from Cloudflare Turnstile when a sign-in form is verified.
- Asset cache: the service worker stores app files so it starts faster.
We use no third-party analytics platforms or advertising pixels.
2. How to control it
- signing out deletes the session tokens;
- your browser settings let you delete the site’s cookies and local data — after that you will need to sign in again and the chosen feed city is reset;
- in the mobile app the data is removed when you uninstall the app or clear its data in system settings;
- deleting your account also deletes the associated server-side data — see Deleting your account and data.
3. Why there is no consent banner
A “please accept cookies” banner is required for storage the service does not need in order to work — that is, for analytics and advertising trackers. Everything listed in section 1 is either strictly necessary to run the Service (session, security) or stores your own choice on your own device (language, theme, feed city) and is never transmitted. Such storage falls within the exemption in Article 5(3) of the ePrivacy Directive and requires no consent.
If we ever add third-party analytics or ad networks, a consent banner will appear, and those technologies will stay off until you answer. As of this edition there are none.
Do Not Track and Global Privacy Control. We do not act on the Do Not Track signal — no single standard for interpreting it has emerged, and by design we do not track you across third-party sites. The Global Privacy Control signal is honoured as an opt-out of sale and sharing; see section 13 of the Privacy Policy.
Edition of 2026-09-09.