Legal
Cookie policy
In plain language
- We set two cookies. One remembers the language you picked. One keeps you signed in. That is the entire list.
- There is no analytics cookie, no advertising cookie and no third party tracker on this site. None has been built and none is planned.
- We use no local storage, no session storage and no browser database. Close the tab and nothing of ours is left behind except those two cookies.
- There is no cookie banner, because a site with nothing to consent to has nothing to ask you about.
- Refuse both and the site still works. You are signed out, and the language follows your browser instead of your choice.
This summary is not a replacement for the text below, but if the two ever disagree, treat the disagreement as our mistake and tell us.
The whole list is two cookies
Most cookie policies run long because the site sets forty cookies. This one runs long because the list is short and the reasons take more space than the list does.
The two are NEXT_LOCALE and better-auth.session_token. Neither carries an advertising identifier, neither is read by anyone but us, and neither follows you to another website. Over HTTPS the second is named __Secure-better-auth.session_token, which stops a page served over plain HTTP from overwriting it.
Every cookie this site sets
| Cookie | What it does | How long it lasts | Flags |
|---|---|---|---|
| NEXT_LOCALE | Remembers the language you chose | Until the browsing session ends | SameSite Lax, readable by the page |
| better-auth.session_token | Keeps you signed in | 30 days, renewed every 24 hours | HttpOnly, Secure, SameSite Lax |
There is no third row. Analytics, advertising and preference cookies are absent because none is set.
NEXT_LOCALE, the language cookie
It holds one value, a language tag such as fr or ja, and nothing else. Pick a language from the switcher in the header and we write the choice here, where it outranks everything else on your next visit.
We resolve your language in this order: this cookie, then the Accept Language header your browser sends, then English. Your IP address is never part of that decision, so a German speaker in Shanghai gets German.
It is a session cookie with no expiry date set, so your browser drops it when the session ends. It is SameSite Lax on a path of /, and not HttpOnly, because the switcher writes it from the page itself. Each of the 12 languages also has its own URL, so a bookmark works whether or not the cookie survives.
better-auth.session_token, the sign in cookie
This one holds a random session identifier and nothing readable. Not your email address, not your name, not your balance, not what you bought. Those live in our database, and the cookie is only the key to the row.
It is set when you sign in and at no other time. It lasts 30 days and is renewed at most once every 24 hours while you keep using the site, so a long trip does not sign you out at the worst moment. Signing out deletes it at once, on our servers as well as in your browser.
It is HttpOnly, so scripts on the page cannot read it, and SameSite Lax, so your browser does not attach it when another site posts to us. Our phone apps do not use it at all. They keep the session as a bearer token in the device keychain instead.
What we do not set
No currency cookie. An earlier version of this page claimed one. We do not set it and never did. Every price is in US dollars, formatted in your language's conventions, and nothing about that is stored on your device.
- No analytics cookie. There is no Google Analytics tag, no Plausible, no PostHog and no product analytics library in this site's code at all.
- No advertising or remarketing cookie, and no conversion pixel from any ad network.
- No local storage, no session storage, no IndexedDB and no service worker holding your data.
- No fingerprinting. We do not measure your canvas, your fonts or your audio stack to rebuild an identifier after you clear a cookie.
- No cookie wall. Hiding a page behind a consent dialogue is hostile, so we would rather set fewer cookies than design a nicer dialogue.
Third parties, named
Three, and only one can set a cookie in connection with your visit. Our hosting provider also keeps short lived server logs containing IP addresses, for security and abuse handling. A log is not a cookie, and the privacy policy covers it.
- Stripe. Payment is taken on Stripe's own hosted checkout page, where Stripe sets its own cookies on its own domain to detect fraud. None of their script runs on our pages.
- Google Fonts. Two typefaces come from fonts.googleapis.com and fonts.gstatic.com. Google sets no cookie from those hosts, but does receive your IP address and browser user agent.
- Google and Apple sign in. Only if you press those buttons, which hands you to their consent screen and their cookie rules.
What breaks if you refuse
Almost nothing, which is the point of keeping the list short. Block the language cookie and the site still works in all 12 languages. Your choice simply stops persisting, so you land on whatever your browser asks for and pick again.
Block the sign in cookie and you can still read every page, compare every plan, check coverage in 145 destinations and open a support conversation. What you cannot do is stay signed in, so your wallet, orders and eSIM profiles are out of reach. Nothing else is hidden or degraded.
How to clear them, browser by browser
Delete both whenever you like. Doing so signs you out on that device only. Each browser below also has a per site rule that blocks cookies for one domain permanently, and using it here is supported rather than merely tolerated.
- Chrome on desktop. Settings, Privacy and security, Third party cookies, See all site data and permissions. Search for our domain and delete it.
- Chrome on Android. Settings, Site settings, Data stored. Find our domain and choose Delete data.
- Safari on macOS. Safari, Settings, Privacy, Manage Website Data. Search for our domain and remove it.
- Safari on iPhone or iPad. Settings, Apps, Safari, Advanced, Website Data. Swipe to delete our entry.
- Firefox. Settings, Privacy and Security, Cookies and Site Data, Manage Data. Search for our domain and remove it.
- Edge. Settings, Cookies and site permissions, Manage and delete cookies and site data, See all cookies and site data.
The legal basis, and your rights
Both cookies are strictly necessary under Article 5(3) of the ePrivacy Directive and the laws implementing it, so neither needs your consent. A sign in cookie is necessary because you asked to be signed in. A language cookie is necessary because a preference you set yourself is an exempt case in the regulators' own guidance.
Where a cookie handles personal data, our lawful basis under the GDPR is Article 6(1)(b), performance of the contract you asked for. Your rights of access, correction, deletion, portability and objection are in the privacy policy and apply here unchanged. We do not sell personal data or share it for cross context behavioural advertising, so there is no Do Not Sell or Share link for readers in California.
This page changes when the code changes. If you find a cookie set by this site that is not listed above, that is a defect, and we would rather hear it from you. Support answers in under 60 seconds, 24 hours a day.