Legal
Cookie Policy
Last updated: October 2026
The short version
We set only the cookies needed to keep you signed in and the site secure. There are no advertising, analytics or social-media tracking cookies. The one optional thing is video embedded from YouTube, Vimeo or Loom, and it stays off until you allow it.
1. What cookies are
Cookies are small text files a website stores in your browser. Browsers also offer similar storage (“local storage” and “session storage”), which this policy covers too. This page lists every one Submit Your Startup uses. How we handle personal data in general is in the privacy policy.
2. Strictly necessary cookies
These make the site work: signing in, protecting forms from forgery, and remembering your choice on this page. The law lets us set them without asking, so they can’t be switched off here (you can block them in your browser, but then you can’t sign in). If you only browse and never choose, this site sets no cookie at all.
| Name | What it does | How long it lasts |
|---|---|---|
| authjs.session-token | Keeps you signed in. A signed, encrypted token tied to your account; it holds no browsing history. | 7 days, renewed at most once a day while you use the site. Removed when you sign out. |
| authjs.csrf-token | Protects the sign-in and sign-out forms from forged requests. | Until you close the browser. |
| authjs.callback-url | Remembers the page to return you to after you sign in. | Until you close the browser. |
| authjs.pkce.code_verifier, authjs.state, authjs.nonce | Short checks that make signing in with GitHub or Google safe. Only set while you sign in that way. | 15 minutes. |
| syn_consent | Remembers what you chose in the cookie banner, so we don't ask on every page. | 180 days, then we ask again. |
| __cf_bm | Set by Cloudflare, which sits in front of this site, to tell people from automated traffic. It may appear when Cloudflare's bot protection is active; it is not ours and carries no account information. | About 30 minutes. |
Over HTTPS, browsers show the first four with a __Secure- or __Host- prefix. All but the last are set by this site itself.
3. Browser storage
| Name | What it does | How long it lasts |
|---|---|---|
| sys:submit-draft | Your unsent startup submission, saved in this browser so a reload doesn't lose your work. It stays on your device until you submit or clear it. | Until you submit the form or clear site data. |
| sys:theme | Your light or dark choice, if you pressed the toggle. Without it the site follows your device's setting. | Until you switch back to your device's setting or clear site data. |
| sys:stale-deploy-reload | A timestamp that stops the page from reloading in a loop after we ship an update. | Until you close the tab. |
4. Security check
The sign-up, sign-in and submit forms load a bot check from Cloudflare Turnstile (challenges.cloudflare.com). Cloudflare sees your IP address and some browser signals to tell people from scripts, and may use its own cookies or storage for that. We treat it as strictly necessary for security. See Cloudflare’s privacy policy.
5. Embedded video (only with your permission)
Some startup pages embed a video from YouTube, Vimeo or Loom. Nothing is requested from them until you press play, and before the first one we ask. Once a video loads, the provider can set its own cookies and sees your IP address, under its own policy. YouTube is loaded from its privacy-enhanced domain, youtube-nocookie.com.
- YouTube: Google privacy policy
- Vimeo: Vimeo privacy policy
- Loom: Loom privacy policy
Videos uploaded straight to a listing play from our own storage and need no permission.
6. Sites you leave us for
Paying goes through Stripe’s own checkout page, and signing in with GitHub or Google takes you to their pages. Those sites set their own cookies under their own policies, not this one.
7. What we don't use
No analytics cookies, no advertising or retargeting, no social-media pixels, no fingerprinting. Founders see daily view and click totals for their listing and the website the visit came from, counted on our server without a cookie and without recording who you are.
8. Your choices
Change or withdraw permission at any time: , or use “Cookie settings” in the footer of any page. Turning embedded video off stops further loading; cookies a provider already set stay until you delete them in your browser’s settings. You can also block or delete cookies there at any time; deleting the strictly necessary ones signs you out.
9. Changes and questions
If we add anything that needs your permission, the banner asks again and this page is updated; the date above shows the current version. Questions: [email protected].