TugaMeetCookie policy
Sign-in cookies
The tugameet_access_token cookie is HttpOnly, SameSite=Lax and Secure in production, lasting at most 7 days. The session may expire earlier, including after 1 hour of inactivity. These mechanisms authenticate and protect requests, not advertising.
OAuth flow cookies
tugameet_oauth_MICROSOFT, tugameet_oauth_GOOGLE and tugameet_oauth_FACEBOOK bind requests to the browser for up to 10 minutes. tugameet_social_profile supports profile completion for up to 1 hour and tugameet_social_challenge supports 2FA for up to 5 minutes. They depend on the chosen flow and are removed or expire afterwards.
Session storage
sessionStorage holds the sign-in token, profile search filters and temporary navigation, conversation, expired-session, deletion and social-link hints. The social-link hint lasts 10 minutes. This is tab-session storage, distinct from cookies; restoration also depends on the browser.
Local preferences and notifications
localStorage remembers language, theme and some profile-completion invitation states without a defined automatic expiry. You can clear them in the browser. Enabling notification-based 2FA may register a service worker and push subscription, revocable through available settings or the browser.
Services loaded in the browser
Cloudflare Turnstile provides anti-abuse protection. Google Fonts loads Inter; Open-Meteo receives city searches and external servers may supply event images. These requests transmit necessary network data, including IP addresses. OAuth providers may use storage on their own pages. Their presence is not proof of TugaMeet advertising tracking.
Audience measurement and choices
No advertising pixel or audience analytics tool was identified in the audited code. No fictional banner is added. Necessary mechanisms and requested preferences are distinguished from optional tracking. Introducing consent-based tracking requires appropriate information and prior choice. Actual provider settings remain to be checked.