# Cookie policy

**Draft.** This document is awaiting review by counsel and may change. Version 2026-10-17.

> Listed uses only the cookies it needs to work: a session cookie, a short-lived sign-in state cookie, and a theme preference kept in your browser.

Updated Oct 17, 2026.

Listed is a service operated by Valor Security.

Effective Oct 17, 2026. Version 2026-10-17.

## The short version

Listed uses only what it needs to work. There are no analytics cookies, no advertising cookies and no third-party trackers on our pages. Because every cookie we set is strictly necessary, the site shows no cookie banner. You can read every public page without any cookie at all.

## What we set

| What | Why | Type | How long |
| ---- | ---- | ---- | -------- |
| Session cookie | Keeps you signed in, and identifies your session so you can see and end it from your account page | First-party cookie. `HttpOnly`, `Secure`, `SameSite=Lax`, with a `__Secure-` name prefix. Replaced with a new one each time you sign in | Until you sign out, the session expires, or you sign out everywhere |
| Sign-in state cookie | Protects sign-in, social sign-in, two-factor and agent consent against cross-site request forgery, and carries state from one step to the next | First-party cookie. `HttpOnly`, `Secure` | Minutes, for the length of the step |
| Theme preference | Remembers whether you chose the light or dark theme by hand | Stored in your browser. It holds only that choice | Until you clear it or choose "follow my system" |

If you never sign in and never switch the theme by hand, we set nothing.

## What other sites set

- **Stripe.** Checkout and the billing portal run on Stripe's own pages, which set Stripe's own cookies under [Stripe's privacy policy](https://stripe.com/privacy). No Stripe script runs on Listed's pages.
- **Google and GitHub.** If you choose to sign in with one of them, you go to their site for that step, and their own cookie policies apply there.
- **Files.** Uploaded files are served from a separate domain that sets no cookies.

## Your choices

You can block or delete cookies in your browser settings. If you block the session cookie you cannot stay signed in, but every public page still works.

## Changes

If we ever add a cookie that is not strictly necessary, we will update this policy first and ask for your consent before setting it.

## Contact

Questions about cookies go to privacy@listed.markets. The [Privacy policy](/legal/privacy) explains everything else we do with personal data.

Other documents: [/legal.md](/legal.md)