Last updated: 30 September 2026
1. What are cookies?
A cookie is a small text value stored by a browser and sent back with later requests. First-party cookies are set under moayad.app. A hosting service may also create a technical cookie under the domain to operate a specific feature.
2. Cookies currently used
This table reflects a code and Production review as of the last updated date without reading cookie or token values. A clean public browser without sign-in or Toolbar showed only NEXT_LOCALE; authentication cookies appear in Portal or Admin after sign-in, while Vercel Toolbar cookies are limited to an authorised reviewer's browser.
| Name | Set by | Domain and path | When created | Purpose | Duration | Evidence | Choice | Removal |
|---|---|---|---|---|---|---|---|---|
| NEXT_LOCALE | next-intl middleware | moayad.app · / | When a public locale route is visited | Routes the interface to the current locale | Browser session | Actually observed in a clean Production public visit | Functional; no separate opt-in | Switch language or clear site data; it may be recreated on a later visit |
| __Secure-moayad.session_token | Better Auth within the application | moayad.app · / | After sign-in | Session authentication and secure access | Up to 12 hours, or session-only when not remembered | Actually observed in a Portal context | Created as a consequence of choosing to sign in | Sign out or clear site data; security events may also revoke it |
| __Secure-moayad.session_data | Better Auth within the application | moayad.app · / | With sign-in or session refresh when the library creates it | Short-lived session cache; never bypasses server checks | Session cookie when observed; cached payload freshness up to 5 minutes | Actually observed in a Portal context | Sign-in dependent, not a separate preference | Sign out, clear site data, or wait for expiry |
| __Secure-moayad.dont_remember | Better Auth within the application | moayad.app · / | When the sign-in session is not remembered | Keeps access bound to the browser session | Session | Actually observed in a Portal context | Follows the remember-sign-in choice | Sign out, close the session, or clear site data |
| __Secure-moayad.two_factor | Better Auth within the application | moayad.app · / | Only during a 2FA challenge | Completes two-factor authentication | Up to 10 minutes | Found in code; not observed in the current visit | Security-related when 2FA is enabled; not a marketing preference | Complete the challenge, wait for expiry, or clear site data |
| __Secure-moayad.trust_device | Better Auth within the application | moayad.app · / | Not created by the current Moayad UI, which submits trustDevice=false | Could remember a trusted device if the feature is offered later | Up to 30 days if enabled in the future | Code capability only; not observed and no current UI choice | Must remain explicit and off by default if later offered | Revoke the device or clear site data; there is no active choice to undo today |
| moayad_admin_theme | Moayad Admin interface | moayad.app · /admin | After changing the Admin theme | Stores the Admin interface theme | One year | Actually observed in an authorised browser and supported by code | User choice | Change theme or clear site data |
| moayad_admin_language | Moayad Admin interface | moayad.app · /admin | After changing the Admin language | Stores the Admin interface language | One year | Found in code; not observed in the current visit | User choice | Change language or clear site data |
| _vercel_session | Vercel Toolbar | moayad.app · / | In an authorised reviewer's Toolbar-enabled browser | Operates the Toolbar session | Session | Actually observed with Toolbar; absent from the clean public visit | Authorised-reviewer context, not a public visitor choice | Disable or sign out of Toolbar, or clear site data |
| __vercel_toolbar | Vercel Toolbar | moayad.app · / | In an authorised reviewer's Toolbar-enabled browser | Stores Toolbar state | Approximately one year | Actually observed with Toolbar; absent from the clean public visit | Authorised-reviewer context, not a public visitor choice | Disable or sign out of Toolbar, or clear site data |
3. Essential cookies
Session, authentication, and security cookies support sign-in, account protection, and server-side authorization. Blocking them may prevent the client portal or Admin interface from working correctly.
4. Authentication and session cookies
Signed Better Auth cookies prove a session, apply the choice not to remember it, and complete two-factor authentication. In Production, authentication cookies use the __Secure- prefix and HttpOnly, Secure, and SameSite=Lax attributes where appropriate. A cookie value alone never grants access beyond server-side checks.
5. Security cookies
A short-lived cookie may be created for a two-factor challenge. Better Auth is technically configured to support remembering a trusted device for up to 30 days, but the current Moayad UI does not offer that choice and submits trustDevice=false in the reviewed 2FA flows. It is therefore not described as an active user feature. If it is offered later, it must be explicit, off by default, and accompanied by a way to revoke it.
6. Preference storage
Admin stores language and theme after a user selects them. The public site stores the homepage audio choice, while sessionStorage keeps testimonial order stable and holds retry-safe operation identifiers. The following table lists each key found in Moayad code or actually observed in the Toolbar context and separates user choices from automatic functional state.
| Name | Type | When created | Purpose | Duration | Evidence | Choice | Removal |
|---|---|---|---|---|---|---|---|
| moayad:home-motion | localStorage | Historical preference; homepage motion now follows the device automatically | Stores the choice of video and cinematic navigation or reduced motion | Until changed or cleared | Written only after user choice; absent with the default device setting | User choice | No longer read or written; old values may be cleared with site data |
| moayad:homepage-audio-muted | localStorage | Public homepage after audio is played or muted | Stores the audio preference | Until cleared | Actually observed in a browser that had interacted with audio; absent from the clean visit | User choice | Change the audio state or clear site data |
| moayad.testimonials.order.v1 | sessionStorage | When homepage testimonial ordering loads | Keeps random display order stable within the session | Tab session | Actually observed in a clean Production visit | Automatic presentation logic; not user tracking | Close the tab or clear site data |
| moayad:approval:<organization>:<user>:<project> | sessionStorage | When an Admin approval operation is displayed | Stable operation identifier preventing duplicate effects on retry | Tab session or until a new operation follows confirmed success | Found in code; not observed in the current visit | Created when the operation starts, not a preference | Close the tab or clear site data; rotated after confirmed success for a new operation |
| moayad:project-delivery:<organization>:<user>:<project>:<deliverable>:<version> | sessionStorage | When Admin project delivery is displayed | Prevents duplicate delivery recording on retry | Tab session or until a new operation follows confirmed success | Found in code; not observed in the current visit | Created when the operation starts, not a preference | Close the tab or clear site data; rotated after confirmed success |
| moayad:portal-revision:<organization>:<account>:<project> | sessionStorage | When a Portal revision request is displayed | Prevents duplicate revision creation on retry | Tab session or until a new operation follows confirmed success | Found in code; not observed in the current visit | Created when the operation starts, not a preference | Close the tab or clear site data; rotated after confirmed success |
| vercel-toolbar-position | localStorage | Authorised-reviewer Vercel Toolbar context | Toolbar position | Until cleared | Actually observed only in a Toolbar-enabled browser | Authorised-reviewer preference | Disable Toolbar or clear site data |
| __vercel_toolbar_injector | localStorage | Authorised-reviewer Vercel Toolbar context | Internal Toolbar injection state; detailed semantics were not established in project evidence | Until cleared | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Disable Toolbar or clear site data |
| vercel-toolbar-activated | sessionStorage | Authorised-reviewer Vercel Toolbar context | Toolbar activation state | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
| _vtip | sessionStorage | Authorised-reviewer Vercel Toolbar context | Internal Toolbar state; detailed semantics were not established in project evidence | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
| _vttsoip | sessionStorage | Authorised-reviewer Vercel Toolbar context | Internal Toolbar state; detailed semantics were not established in project evidence | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
| vercel-preview-skip-animation | sessionStorage | Authorised-reviewer Vercel Toolbar context | Toolbar motion preference | Tab session | Actually observed only in a Toolbar-enabled browser | Reviewer-interface behaviour | Close the tab, disable Toolbar, or clear site data |
| vercel-live-feedback-hidden | sessionStorage | Authorised-reviewer Vercel Toolbar context | Vercel feedback visibility state | Tab session | Actually observed only in a Toolbar-enabled browser | Reviewer-interface behaviour | Close the tab, disable Toolbar, or clear site data |
| tool-used-this-session | sessionStorage | Authorised-reviewer Vercel Toolbar context | Tool-use state for the session | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
| vc-mfe-session-cleared | sessionStorage | Authorised-reviewer Vercel Toolbar context | Internal Toolbar state; detailed semantics were not established in project evidence | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
| vc-microfrontend-enabled | sessionStorage | Authorised-reviewer Vercel Toolbar context | Internal Toolbar state; detailed semantics were not established in project evidence | Tab session | Actually observed only in a Toolbar-enabled browser | Associated with Toolbar operation | Close the tab, disable Toolbar, or clear site data |
7. Analytics cookies
No analytics cookies are currently enabled. Google Analytics, PostHog, and similar measurement tools are not active in Production.
8. Advertising and marketing cookies
No advertising or marketing cookies are currently enabled. The site does not currently use Meta Pixel, TikTok Pixel, or retargeting tools.
9. Third-party cookies
Public pages currently load no third-party analytics or advertising cookies. Technical Vercel Toolbar cookies may appear for collaborators authorised to manage or review a deployment; they are not part of an ordinary visitor's experience. External links do not set the destination service's cookies on moayad.app before you leave the site.
10. Browser controls
You can view, delete, or block cookies in your browser settings. Clearing site data can also remove localStorage and sessionStorage. The steps vary by browser and device.
11. Effect of disabling essential cookies
Blocking essential cookies may prevent sign-in, session continuity, two-factor authentication, or account features. Public pages that do not require an account will generally remain available without authentication cookies.
12. Consent and future changes
The public site currently uses no analytics, advertising, or marketing cookies. On the observed behaviour, there is no demonstrated technical reason for a general consent interface today: public automatic storage is functional, sign-in storage supports a session the user chooses to create, and audio and Admin preferences are created at the feature choice. This is a technical assessment of current disclosure and behaviour, not final legal approval.
Functional and security storage should be disclosed, while preferences should remain changeable or removable at the feature or through browser settings. If analytics, advertising, marketing, or another non-essential preference is introduced before user choice, the inventory and appropriate consent mechanism must be assessed before activation.
13. Updates and contact
The last updated date appears above. Questions about cookies or privacy can be sent to support@moayad.app.