Cookie Policy
Last updated: September 23, 2026
What is a cookie?
A cookie is a small text file that a website stores in your browser. It lets the site remember something between page loads or visits, such as that you're signed in, or how you last arranged part of the interface. Cookies can't run programs or carry viruses, and by themselves they don't identify you personally.
Cookies we use
This is the complete, current list of cookies Meridian sets. We don't use a third-party cookie-scanning tool for this table. It's a direct account of what our own code sets, kept up to date by hand whenever that changes.
| Name | Purpose | Category | Lifetime | Set by |
|---|---|---|---|---|
__Secure-authjs.session-token (authjs.session-token without HTTPS) | Keeps you signed in between page loads. | Strictly necessary | 30 days, or until you sign out | Meridian |
__Host-authjs.csrf-token (authjs.csrf-token without HTTPS) | Protects the sign-in form against cross-site request forgery. | Strictly necessary | Session (cleared when you close your browser) | Meridian |
__Secure-authjs.callback-url (authjs.callback-url without HTTPS) | Remembers where to send you back to after you sign in. | Strictly necessary | Session (cleared when you close your browser) | Meridian |
sidebar_state | Remembers whether the app's sidebar is expanded or collapsed. | Functional | 7 days | Meridian |
ph_<project-key>_posthog | Holds an anonymous analytics ID so PostHog can recognise the same browser across visits, for product-usage analytics and session replay. | Analytics (opt-in only) | 1 year | PostHog (only after you click Accept analytics) |
The __Secure- and __Host- prefixes above are added automatically whenever you access Meridian over HTTPS, as you always do in production; without HTTPS (local development only) the same cookies are set without a prefix, as shown in the table. The session and CSRF cookies are readable only by our server, never by page scripts. Three of the four cookies above, everything except sidebar_state, are also marked so your browser will only ever send them back over an encrypted connection when you're on HTTPS. sidebar_state is set directly by a small script in the page itself rather than by our server, so it doesn't carry that protection.
Similar technologies
Alongside cookies, Meridian stores a couple of small values in your browser's local storage, which works like a cookie but never travels back to our server on its own:
themeremembers whether you've chosen light mode, dark mode, or to match your system setting.pmo-storageremembers which project you last had selected, so the app can reopen where you left off.meridian.cookie-notice.v2remembers your cookie choice (Accept analytics or Decline), so the banner doesn't reappear on every visit.
If you click "Accept analytics", PostHog additionally writes a few of its own browser-storage entries, all removed again if you later change your choice to Decline:
ph_<project-key>_posthog(local storage) holds your anonymous analytics ID.__ph_opt_in_out_<project-key>(local storage) records that you opted in.ph_<project-key>_window_idandph_<project-key>_primary_window_exists(session storage, cleared when you close the tab) identify the current browser tab.- While a session replay recording is in progress, a temporary session-storage buffer holds the not-yet-sent recording data for that tab.
Analytics cookies (optional)
With your permission, Meridian uses PostHog for privacy-friendly product analytics (which pages and features get used) and session replay (a recording of how a page was used). In a replay recording, every input value and all visible text is masked, and images are blocked outright rather than recorded; a replay can still show the general layout and structure of a page (for example, that a form had five fields, or where a link was) even though it never shows what the text or an image actually said. PostHog is hosted in the EU (Frankfurt), and no analytics cookie is set until you click "Accept analytics" on the cookie banner; until then, any usage data is anonymous and cookieless, tied to nothing that persists between page loads.
Declining, or not choosing, keeps you in that cookieless state: no persistent identifier, no cookie, and no session replay. You can change your choice at any time: from the "Cookie preferences" link in the footer on our marketing pages, from your account menu once signed in, or from the same link near the sign-in, sign-up, and contact forms.
What we don't use
Meridian sets no advertising cookies and no cross-site tracking cookies of any kind. There is no ad pixel and nothing that follows you across other websites. The strictly necessary and functional cookies above are required for the product to function or are small functional preferences; only the analytics cookies above are optional, and those are exactly what the Accept/Decline choice on the cookie banner controls.
Controlling cookies
Every browser lets you view, delete, or block cookies through its settings. Search your browser's help for "cookies" for exact steps. Be aware that blocking or deleting __Secure-authjs.session-token (authjs.session-token without HTTPS) will sign you out, and blocking it entirely will prevent you from signing in to Meridian at all, since that cookie is how the product recognizes a signed-in session.
Changes to this policy
If the cookies we set change, we'll update this page and the date at the top. Check back here if you want to know what's currently in use.
Questions
If you have questions about this policy, the best way to reach us is through our contact form.
See also: Privacy Policy.