better-auth.session_token or __Secure-better-auth.session_token — essential, first-party — maintain authenticated session — duration: 2 hours without remember-me or 24 hours with remember-me — legal basis: contract performance (LGPD, art. 7, V).
NEXT_LOCALE — essential/functional, first-party — remember preferred language (pt-BR, en, es) — duration: persistent per browser — legal basis: contract performance.
sm_confirmation_challenge — essential, first-party — validate confirmation of sensitive actions (e.g., restore) — duration: approximately 5 minutes — legal basis: legitimate interest in security (art. 7, IX).
sm_cookie_consent — essential, first-party — record your cookie preferences — duration: up to 12 months — legal basis: transparency obligation and proof of consent.
Google reCAPTCHA cookies (e.g., _GRECAPTCHA) — third-party security — prevent sign-up abuse when enabled by the administrator — duration: per Google — legal basis: consent (art. 7, I) — loaded only after acceptance.
Google OAuth cookies — third-party — social login when you click Sign in with Google — duration: per Google — legal basis: contract performance at your request.
Algolia cookies — third-party functional — panel search when the feature is configured — duration: per Algolia — legal basis: consent (art. 7, I) — loaded only after acceptance.
localStorage (theme and fleet layout) — similar technology, first-party — interface preferences — no fixed expiry until you clear the browser — legal basis: contract performance / service experience.