1. Essential authentication cookies
These cookies keep user accounts secure and enable Google or email-code sign-in. They are not used for advertising.
- xpomag_access: short-lived signed customer access token (approximately 10 minutes).
- xpomag_refresh: rotating session credential (up to 30 days, unless revoked).
- xp_google_state, xp_google_verifier, xp_google_nonce, xp_google_next: short-lived Google OAuth anti-forgery, PKCE, nonce and intended-destination values (approximately 10 minutes).
- xpomag_google_pending: short-lived Google identity awaiting email verification, when a second verification step is necessary (approximately 10 minutes).
2. Browser storage and optional cookies
Some browser data, such as local interface settings, may be stored when features require it. The current authentication flow does not require advertising cookies. If optional analytics, personalization or third-party media cookies are introduced, their providers, purposes, durations and consent choices must be documented and configured before deployment.
3. Controlling cookies
You can clear or block cookies through your browser settings. Blocking essential authentication cookies will prevent account sign-in and session persistence, but public publishing pages may remain accessible. Signing out revokes the current refresh session and clears authentication cookies.
4. Third-party services
Choosing Sign in with Google redirects you to Google's own authentication service, which may set cookies governed by Google's policies. Embedded content within individual publications may have separate provider controls, which publishers must disclose where applicable.
5. Questions
For cookie and privacy questions, contact support@xpomag.com. See our Privacy policy.