BROWSER STORAGE
Cookies & storage.
The public information pages do not add advertising or audience-analytics cookies. Invitation-only account access is being prepared; ordinary browsing does not start an account sign-in session.
Last updated 15 November 2026.
Why these are used
The account entries below describe the configured sign-in flows for restricted testing and future invited access. They are not a statement that public sign-in or invitation redemption is currently open.
A sign-in cookie lets the service recognise the session you asked to start. Short-lived security cookies connect the beginning and end of a sign-in attempt. The account notice’s “Got it” control dismisses information; it is not agreement to advertising or optional tracking.
We rely on the relevant necessary-service/security exceptions for purpose-limited sign-in storage. If optional tracking is introduced later, it will be assessed separately and consent requested where required before it runs.
Website sign-in cookies
These cookies are separate for each website. They are sent over HTTPS, are not readable by page scripts and are restricted to the host that sets them.
__Host-cake_sessionOn cakemods.com or 9to1.uk after successful website sign-in. Holds an opaque reference to the website session, rather than the account’s access or refresh tokens. Configured lifetime: up to 7 days. It can end sooner through sign-out, expiry or revocation.
__Host-cake_oauthOn the website where you begin sign-in. Protects the return from the account service by tying it to that attempt. Configured lifetime: up to 10 minutes; cleared when the website processes the callback.
9to1 Account cookies
The account service currently uses cake-id-release-validation.. Its cookie names retain the authentication software’s name; this does not change the service name, 9to1 Account.
__Secure-better-auth.session_token Recognises an authenticated account session. Configured session lifetime: 30 days, with renewal during use. Sign-out or revocation can end access earlier.
__Secure-better-auth.state Used by the database-backed external sign-in flow, such as optional Google sign-in, to check the returning browser. Configured cookie lifetime: 5 minutes; removed when that flow is processed.
__Secure-better-auth.dont_remember May be set when a supported authentication request asks for a non-persistent session. This is a browser-session preference, not an advertising identifier.
__Secure-better-auth.session_token. oauth_logout_confirmation May be used by an identity-provider sign-out confirmation flow. Configured lifetime: up to 5 minutes.
These are sign-in/security cookies on the account-service host. Not every flow sets every cookie. Browser session restoration can affect how long session-only storage remains available.
Notice preference
The account page uses a session-storage entry named nine-account-cookie-notice-v1 to remember that you dismissed its notice in that browser tab. It contains the word “dismissed”, not your account information. It normally lasts for the tab’s session. You can reopen the notice using “Cookie information” in the account footer.
Cloudflare security checks and restricted areas
Where an account form uses Cloudflare Turnstile, the security check processes browser/network signals and a one-time challenge token. Cloudflare can also use security cookies when a challenge or access-control feature requires them. For example, cf_clearance is conditional on challenge/pre-clearance settings; restricted pages can use Cloudflare Access authentication cookies. Their presence and lifetime depend on the applicable security configuration.
See Cloudflare’s Turnstile privacy information and challenge-cookie explanation, or contact support@9to1.uk about a security cookie you see and its configured lifetime.
Google and other external websites
Choosing Google sign-in takes you to Google, where Google may use its own cookies under its privacy policy. Following a link to a community or another external website can also result in that service using its own storage. Those cookies are not set by the CAKE or 9to1 brochure pages.
Your controls
You can inspect or remove cookies and site storage through your browser settings. Blocking sign-in or security storage can prevent account access or force you to sign in again. Clearing browser storage does not itself delete your server-side account; contact support@9to1.uk if you want to request account closure or erasure.
Cookie lifetimes describe browser expiry, not the retention of every related database record, provider log or backup. Read the privacy notice for the distinction.