Cookies and local storage

Internationalized routing may set a first-party functional cookie named NEXT_LOCALE to remember English or Chinese. It contains no photo, account data, or advertising identifier.

Creators sign in using first-party authentication session cookies. Public puzzles use a random photo_puzzle_session cookie, lasting up to one year, to count opens and finishes once per browser and puzzle. It contains no photo or display name; the server stores a puzzle-specific hash. Clearing it can count a later visit again. Clearing authentication cookies signs you out. Clearing browser data does not delete published puzzles; delete those from My puzzles.

localStorage is not a cookie. After successful AI analysis, the app uses a key beginning with keepsake-match:analysis:v4: to store schema v3 candidate IDs, labels, clues, visible-extent and occlusion markers, normalized rectangles, code-selected targets, and rejection diagnostics in the current browser. Old caption drafts are discarded on load and are not used on non-sample completion cards. The entries are scoped to the page language and the rest of the key includes the photo's SHA-256 digest; the cache contains no photo pixels. Selecting the same file through the automatic flow can build from a valid cache without another upload or model call.

The sample and manual-selection modes do not create this AI cache. Old v1–v3 entries are not migrated, so the first use of the same photo in this flow may require one new analysis. Temporary Blob URLs and Canvas crops exist while the page runs; they are not cookies or a persistent photo library.

Review and publish stores one working photo and its recognized subjects in this browser's IndexedDB while you sign in and review the puzzle. The draft has a random identifier and contains no test token or account credential. It is available for 24 hours and is cleared on later access if expired, after successful publication, or when you discard it. It is not synced to other devices. Clearing this site's browser data also removes it.

The test token used to unlock automatic upload stays only in the current page's React memory. It is not written to a cookie, localStorage, the URL, a database, or application logs. The token is sent as a request header only to this site's same-origin readiness and photo-analysis endpoints. The readiness request contains no photo and makes no vision-model call. Refreshing or closing the page clears the browser's copy of the token.

The local game includes no payment, advertising, PostHog, Google Analytics, or other product-analytics script. Optional AI requests are relayed by this site's server, so the configured provider does not set browser cookies through that request.

Delete this site's cookies and site data in browser settings. Removing NEXT_LOCALE resets only the language preference. Removing localStorage deletes cached AI selections, so selecting the same photo through the automatic flow after a later unlock may require another upload and model call.

A hosting platform may set its own essential cookies. If a public operator adds analytics, support chat, login, or another third-party tool, it must update this page and obtain any consent required by law before enabling it.