Cookies
Last updated 31 October 2026
Draft for review. This page is not legal advice.
Commons needs a few cookies to sign you in. They are always on. One more cookie is optional: a random id that counts return visits and how signed out visitors move through a shared app. It stays on Commons, is never shared with anyone, and is only set if you allow it.
You haven't chosen, so the analytics cookie is off.
Saying no also deletes the id from your browser. Events recorded before that stay anonymous and go after 13 months.
Every cookie Commons sets
| Name | Purpose | Lifetime |
|---|---|---|
| __Host-commons_sid | Keeps you signed in. Essential. | 30 days, or until you sign out |
| __Host-commons_oauth_state | Protects sign in with GitHub or Google. Essential. | 10 minutes |
| __Host-commons_rt | Remembers the page to go back to after sign in. Essential. | 15 minutes |
| __Host-commons_ref | Remembers the invite or shared app that brought you, so you can join during the invite only beta and the person who shared gets credit. Set when you open an invite or choose to sign up from a shared app. If you allowed analytics, also set when you open a shared link. | 30 days, or until sign up |
| __Host-oauth-* | Protects the screen where you approve an agent. Essential. | Up to 1 hour |
| __Host-commons_consent | Remembers your choice about analytics. Essential. | 180 days |
| __Host-commons_anon | A random id that counts return visits and how signed out visitors move through a shared app. Analytics. Only set if you allow it. | 1 year |
More in the Privacy notice.