Cookie Policy

Version 1.0 · Effective 29/08/2026 · The Vietnamese text is the binding version; this English text is a reference translation

TexAPI uses no advertising cookies, no behavioural tracking cookies, and no third-party analytics. Every cookie TexAPI sets is technically necessary for the service to work, plus one that remembers the display language you chose.

1. Why there is no consent banner

Under the accepted application of personal-data protection law, cookies genuinely necessary to provide a service the user actively asked for do not need separate consent. Every cookie in section 2 is either that, or a display preference you set yourself.

If TexAPI later adds any measurement tool, this document and a consent mechanism will be updated before that tool runs — not after.

2. The complete list

This is every cookie the system sets. There are no others.

Name	Purpose	Type	Lifetime
`texapi_session`	keeps you signed in on the account pages	Necessary	30 days
`texapi_admin_session`	a TexAPI operator's session — a customer never receives this cookie	Necessary	8 hours
`texapi_oauth_state`	prevents request forgery when you sign in with Google/GitHub/Discord	Necessary — security	10 minutes
`texapi_oauth_link`	remembers that you are linking a social account rather than signing in afresh	Necessary	10 minutes
`tex-locale`	remembers whether you chose Vietnamese or English	Optional — convenience	1 year

The first four carry the httpOnly flag, so JavaScript on the page cannot read them, and the secure flag in production, so they travel only over an encrypted connection. The tex-locale cookie does not have httpOnly, because it is a display preference and not a credential.

3. What the session cookie contains

Nothing but a random string. The server stores a hash of that string, not the string itself — meaning that if the database were read without authorisation, live sessions still could not be reconstructed. Your name, your email and your balance are not in the cookie.

Alongside the session, the system records the IP address and browser information of the sign-in in the database, so that you can review sessions and revoke an unfamiliar one at Dashboard → Settings → Security.

4. What TexAPI does NOT use

This is the result of auditing the whole source tree and the full dependency tree of all six packages in the project. It is a negative finding that has been verified, not a promise.

There is no Google Analytics, Google Tag Manager, Meta/Facebook Pixel, TikTok Pixel, PostHog, Hotjar, Microsoft Clarity, Mixpanel, Amplitude, Segment, Plausible, Fathom, Matomo, Sentry, Datadog, New Relic, LogRocket, Bugsnag, Rollbar, OpenTelemetry, Vercel Analytics, Vercel Speed Insights, Axiom, Logtail/BetterStack, Highlight.io or Grafana Faro.

There are no tracking pixels, no third-party content delivery network, and no third-party cookie set by TexAPI at all.

5. Two things to state for the sake of completeness

Google Fonts. The project uses three faces from the Google Fonts library. The mechanism downloads them at build time and serves them from here; your browser makes no request to Google when you open the page, and there is no Google cookie.

Discord avatars. If you link a Discord account, your avatar is loaded directly from Discord’s content servers. Your browser then does make a request to Discord — an unavoidable consequence of using a Discord avatar, and it only happens if you chose to link.

6. Local storage on your machine — not cookies

Besides cookies, the interface uses your browser’s local storage to remember the light/dark mode you picked. That data stays entirely on your machine, is never sent to the server, and clearing your browser data clears it.

For the texapi-connect command-line tool, the connection settings — the gateway address and the API key you created — are written into each tool’s config file on your machine. texapi-connect disconnect removes that config and revokes the corresponding key.

7. How you stay in control

What you want	How	Consequence
Delete the session on one machine	Settings → Security → Revoke	that machine has to sign in again
Delete every session except this one	same page, Revoke all	other machines are signed out
Stop using the session cookie	Sign out	the account pages become unusable; API keys keep working normally
Block cookies in the browser	browser settings	you cannot sign in to the account pages; the API is unaffected
Change or clear the language choice	switch language in the interface, or delete the cookie in your browser	back to the default

The important point: API access with an sk-texapi-… key uses no cookies. If you only use TexAPI programmatically, no cookie concerns you at all.

8. Changes

If TexAPI adds any analytics, measurement or advertising cookie, TexAPI will put a consent mechanism in place first and update this document before that cookie is set. Questions about cookies: support@texapi.dev.

The full picture on personal data — of which cookies are only a small part — is in the Privacy Policy.