Last updated: September 6, 2026
Cookie Policy
In one line: Potion uses browser storage for sign-in, preferences, messaging keys and an offline page. External media services may use their own cookies or similar storage when loaded.
Potion does not add its own advertising or analytics tools, and its sign-in flow uses browser storage rather than cookies. The notice linking here is an acknowledgement of this information; dismissing it does not enable or disable external services.
What we store in your browser
The app uses local storage, session storage, IndexedDB and a small offline cache. Browser storage is scoped to this site's origin. Unlike cookies, these values are not automatically attached to every request; app code reads them and sends the session token when authenticating requests.
| What | Why |
|---|---|
token |
Your session token is kept in session storage by default. Choosing "Keep me logged in" stores it in local storage so it can survive closing the browser. The server can expire or invalidate it. |
username, tag, avatar |
Stored in local storage to show your account details without waiting for the server. |
| Muted chats, sound, notification, device and appearance preferences | Local storage remembers settings for this browser. |
potion_cookie_consent |
Local storage remembers that you dismissed the storage notice. |
potion_active_call |
Session storage holds temporary call state to help handle a page reload. |
| Messaging identities and remembered peer keys | The encrypted messaging version uses IndexedDB to keep keys needed to open chats and detect changes to a contact's key. |
| Offline page and app icon | A service worker cache lets the app show an offline page if a navigation fails. It does not cache chats or API responses. |
Logging out clears the sign-in token and cached account details. It does not clear every preference or the messaging keys in IndexedDB. Your browser's site-data controls can remove local storage, session storage, IndexedDB and cached files.
Clearing messaging keys can affect access to old chats. Signing in can restore an identity that has been backed up. After a password reset, an original device may be needed. If no device retains the identity and the old password is unavailable, old encrypted messages may be unrecoverable. Clearing browser data does not delete your account or server-side content.
External services
When these resources load, the provider receives connection information such as your IP address:
- Google Fonts supplies the Manrope typeface on pages that load it.
- YouTube supplies thumbnails for message links and a player for shared videos.
- Spotify supplies a player for shared Spotify media.
- Google STUN and Metered relay servers help establish or relay calls.
Country flags are served with the website. Embedded YouTube and Spotify players may use cookies or similar storage under their providers' policies. Their behavior can depend on browser settings and whether you are signed in to those services. The Potion storage notice does not block these players; use your browser's third-party cookie and site controls to manage their access.
Do Not Track
Potion does not change its behavior in response to Do Not Track. External services handle browser privacy signals according to their own policies.