Cookies are small files stored by your browser. OnLevelUp also uses local storage to remember your light or dark theme. Some mechanisms support sign-in and security; Google Analytics audience measurement, when enabled on the site, depends on your choice.
Choose or change your preferences
The “Manage my cookie choices” button below and the “Manage cookies” footer link open your preferences. You can separately accept or refuse audience measurement and advertising, which includes affiliate tracking. Your choice is stored for 180 days in this browser; clearing cookies resets it.
After changing your choice, reload any open OnLevelUp pages so that they use the new preference. You can delete previously stored trackers in your browser settings. Blocking sign-in cookies may prevent access to your account.
Cookies and storage used by the site
| Name | Purpose | Intended lifetime |
|---|---|---|
| olu-consent | Remember acceptance or refusal of audience measurement | 180 days |
| olu_locale | Remember the language of sign-in pages | 365 days |
| olu_newsletter | Carry the newsletter choice during account creation | Up to 24 hours; removed after processing |
| authjs.session-token | Keep the account signed in | 30 days by default, renewable during account use |
| authjs.csrf-token, authjs.callback-url, authjs.nonce | Protect and complete sign-in exchanges, depending on the method used | Browser session |
| authjs.state, authjs.pkce.code_verifier | Secure external sign-in, where used | Up to 15 minutes |
| olu-theme (local storage) | Remember the light or dark theme | No automatic expiry; until site storage is cleared |
Under HTTPS, Auth.js names may start with __Secure- or __Host-. Your browser may shorten these lifetimes, and signing out invalidates the account session.
External services
The olu-affiliate cookie remembers the last valid affiliate link for 30 days. It is placed and used only with your consent to the “Advertising and conversions” category. It attributes sales so that the relevant affiliate can earn a commission. Withdrawing that consent deletes the cookie. An already attributed subscription and its commissions can be tracked without placing a new cookie for renewals.
When Google Analytics is enabled, its script loads on public pages using Google’s consent mode. Until you accept audience measurement, no Google Analytics cookie is set or read: Google only receives cookieless signals (page viewed, timestamp, technical browser information) used for aggregated statistics. If you accept, it may use cookies such as _ga to measure visits. Refusing or withdrawing your consent immediately restores this cookieless mode. Cookies and their lifetimes also depend on the service configuration: see Google Analytics documentation (opens in a new tab).
When reCAPTCHA protects a form, Google may use the _GRECAPTCHA cookie to assess abuse risk. See Google’s reCAPTCHA information (opens in a new tab) and its privacy policy (opens in a new tab).
Stripe payment pages and external sign-in services may use their own cookies when you open them. Their notices explain their rules; see in particular the Stripe cookie policy (opens in a new tab).
Questions?
Use the contact form to report a preference issue or ask about a tracker.