Cookie Policy
Last updated: September 9, 2026
What is a cookie?
A cookie is a small text file that a website stores in your browser. It lets the site remember something between page loads or visits, such as that you're signed in, or how you last arranged part of the interface. Cookies can't run programs or carry viruses, and by themselves they don't identify you personally.
Cookies we use
This is the complete, current list of cookies Meridian sets. We don't use a third-party cookie-scanning tool for this table. It's a direct account of what our own code sets, kept up to date by hand whenever that changes.
| Name | Purpose | Category | Lifetime | Set by |
|---|---|---|---|---|
__Secure-authjs.session-token (authjs.session-token without HTTPS) | Keeps you signed in between page loads. | Strictly necessary | 30 days, or until you sign out | Meridian |
__Host-authjs.csrf-token (authjs.csrf-token without HTTPS) | Protects the sign-in form against cross-site request forgery. | Strictly necessary | Session (cleared when you close your browser) | Meridian |
__Secure-authjs.callback-url (authjs.callback-url without HTTPS) | Remembers where to send you back to after you sign in. | Strictly necessary | Session (cleared when you close your browser) | Meridian |
sidebar_state | Remembers whether the app's sidebar is expanded or collapsed. | Functional | 7 days | Meridian |
The __Secure- and __Host- prefixes above are added automatically whenever you access Meridian over HTTPS, as you always do in production; without HTTPS (local development only) the same cookies are set without a prefix, as shown in the table. The session and CSRF cookies are readable only by our server, never by page scripts. Three of the four cookies above, everything except sidebar_state, are also marked so your browser will only ever send them back over an encrypted connection when you're on HTTPS. sidebar_state is set directly by a small script in the page itself rather than by our server, so it doesn't carry that protection.
Similar technologies
Alongside cookies, Meridian stores a couple of small values in your browser's local storage, which works like a cookie but never travels back to our server on its own:
themeremembers whether you've chosen light mode, dark mode, or to match your system setting.pmo-storageremembers which project you last had selected, so the app can reopen where you left off.meridian.cookie-notice.v1remembers that you've dismissed the cookie notice on this site, so it doesn't reappear on every visit.
What we don't use
Meridian sets no analytics cookies, no advertising cookies, and no cross-site tracking cookies of any kind. There is no Google Analytics, no ad pixel, and nothing that follows you across other websites. That's also why this page is a disclosure rather than a consent banner with "Accept" and "Reject" buttons: every cookie above is required for the product to function or is a small functional preference, so there's nothing optional to ask your permission for.
Controlling cookies
Every browser lets you view, delete, or block cookies through its settings. Search your browser's help for "cookies" for exact steps. Be aware that blocking or deleting __Secure-authjs.session-token (authjs.session-token without HTTPS) will sign you out, and blocking it entirely will prevent you from signing in to Meridian at all, since that cookie is how the product recognizes a signed-in session.
Changes to this policy
If the cookies we set change, we'll update this page and the date at the top. Check back here if you want to know what's currently in use.
Questions
If you have questions about this policy, the best way to reach us is through our contact form.
See also: Privacy Policy.