Policies / Cookies and Device Identifiers
Cookies and Device Identifiers
Draft for legal review · updated 27 September 2026 · not yet effective
This page describes identifiers used by the website, the creator console, the staff admin app and the app. It must be checked against the deployed website, CDN and any newly added SDKs before it takes effect.
Website, creator console and admin app
The current public website is not designed to set advertising cookies. Website and infrastructure logs may still receive IP addresses and request metadata. Reading the website and its policies sets no cookies. Signing in to watch sets two essential, HTTP-only cookies over HTTPS. Creators use the same two in the creator console, and the staff admin app uses two of its own:
| Cookie | Purpose | Browser lifetime |
|---|---|---|
frames24_session | Short-lived access token that lets a signed-in viewer watch | Until the access token expires |
frames24_refresh | Keeps a viewer signed in on the website | At most 400 days in the browser, unless cleared earlier |
frames24_admin | Short-lived access token for staff in the admin app | Until the access token expires |
frames24_admin_refresh | Admin app session renewal | At most 400 days in the browser, unless cleared earlier |
The server may revoke a token sooner; browser retention does not guarantee an active session. Signing out clears that part's cookies: signing out of the website does not sign staff out of the admin app, or the other way round. The admin app sets its cookies only on its own address.
App identifiers
The app stores authentication tokens and may create a random X-Viewer-Id for eligible signed-out browsing. This is not the phone's advertising identifier. Playback requires authentication. An ad-session identifier helps apply session and frequency limits; its exact storage and retention must be checked against the current client and server before publication. Search history, downloads and drafts may remain on the device after sign-out and can be removed by uninstalling the app or using available controls.
We do not currently integrate a third-party advertising or cross-app analytics SDK. If that changes, we will update this page and any required consent choices. We have not completed a jurisdiction-by-jurisdiction cookie-consent assessment, so this draft does not claim that a banner is never required.
Questions: info@24frames.co. See Privacy Policy.