Skip to content
Terminal
DRAFT, pending counsel review. This notice is not in effect until counsel reviews it and it is published.

Cookies and browser storage

Version: 2026-11-01 draft

Updated 1 November 2026.

Effective: [Effective date: set when published]

This notice lists every cookie Terminal sets and everything Terminal keeps in your browser's storage. It is part of the Privacy Policy.

Summary. We set only our own cookies. No advertising cookies. No analytics or tracking scripts from other companies. No other company sets a cookie through our pages. The site loads no scripts, fonts, or images from other companies.

Cookies

All of these are first-party cookies, set by terminal.tokensmarketcap.com. Each one is HttpOnly, so page scripts cannot read it. Each one uses SameSite=Lax. Each one is Secure when the page is served over HTTPS.

  • terminal_session. Keeps you signed in. How long: 30 days when you sign in with "Remember me" checked, sign in with Google or GitHub, sign in through tokensmarketcap.com, or confirm your email. Right after you sign up, the cookie lasts 30 days but the server ends that first session after 7 days. If you sign in with "Remember me" cleared, the cookie lasts until the browser closes, and the server ends the session after one day.
  • oauth_state. Matches a Google or GitHub sign-in, or a new connection, to your browser, so another site cannot finish it for you. How long: about 10 minutes.
  • oauth_next. Remembers whether that sign-in was to sign in or to connect an account. How long: about 10 minutes.
  • oauth_return. Remembers the page to return to after a Google or GitHub sign-in. How long: about 10 minutes.
  • terminal_invite. Holds a beta invite code you opened, until you sign in or create an account and the invite is used. How long: 7 days, or until it is used.
  • terminal_ref. Remembers the first invite link or shared alert page this browser opened, for the referral program. Not set when you are signed in. A shared alert page does not set it when your browser sends Do Not Track or Global Privacy Control. An invite link you open sets it, because the invite only works with it. How long: 30 days.
  • terminal_vid. A random visitor id for our own sign-up counts, so we can tell which page or link brought a visitor who later signs up. Not set when your browser sends Do Not Track or Global Privacy Control. How long: 180 days.
  • terminal_market. Set when a link turns the marketplace's labelled demo off (Terminal staff use it to see live data). It only remembers that choice. How long: until the browser closes.

terminal_session is needed for the service to work. The sign-in cookies (oauth_state, oauth_next, oauth_return) are needed for Google and GitHub sign-in. terminal_invite is needed for an invite to work, and terminal_ref is needed for a friend's invite link to count. terminal_vid is for our own counts, and your browser's privacy signal turns it off.

Browser storage

The app also keeps a few small values in your browser, in local storage or session storage. They stay on your device. The server does not read them.

  • terminal-theme (local storage). Your light or dark theme.
  • terminal-sidebar (local storage). Whether the app's side menu is open or closed.
  • tmc-signup-coin (local storage). The coin a coin page or article passed to sign-up, with the time, so your first alert setup can start with it. Setup removes it when it reads it, and ignores it after 24 hours.
  • terminal-push-devices (local storage). Which phone or browser alert belongs to this device, so the app can show "this device".
  • ops-changes-seen (local storage). For our own staff accounts only: which change notes were already read.
  • tmc-next (session storage). The page to return to after you sign in.
  • tmc-event: followed by a step name (session storage). Marks that a step, such as a page view, was already counted in this tab, so it is counted once.
  • legal-reload: followed by a page path (session storage). Stops a policy page from reloading itself more than once.
  • terminal-onboarding-clock (session storage). The setup timer shown while you create your first alert.
  • billing-confirm: followed by a checkout id (session storage). Marks that the app already checked a finished checkout.

Session storage ends when you close the tab. Local storage stays until you clear it in your browser.

Offline files

If you install the app or turn on phone alerts, your browser keeps a copy of the app's own files (the cache terminal-shell-v1) so the app opens faster and can show alerts. It holds our code and styles, not your data.

Your choices

You can block or delete cookies in your browser. If you block terminal_session, you cannot stay signed in. If you send Do Not Track or Global Privacy Control, we do not set terminal_vid, a shared alert page does not set terminal_ref, and we record no usage events while you are signed out. The Privacy Policy explains how we treat that signal.

We do not use cookies to track you on other companies' sites, and we do not sell or share cookie data for advertising.

Changes

If we add a cookie or a storage key, we add it here and change the date at the top before it ships.