TL;DR
We don't use marketing cookies. Analytics are cookieless (Plausible).
Strictly necessary
appstrate_session: authentication. 30-day TTL.
csrf_token: form protection. Session TTL.
Preferences
theme: light/dark preference. 365-day TTL.
locale: language preference. 365-day TTL.
Analytics
Plausible — no cookies, no personal data, GDPR-exempt.