CogniPrep's /cookies page makes a specific, checkable promise. It names four cookies:

Supabase authentication cookies, up to 400 days

a device token, 1 year

a country code for currency, 30 days

a landing intent, 30 minutes or until you sign in

and three things in browser storage: the theme, the entry intent, and PostHog's identifiers. Then it explains why there is no consent banner: no advertising cookies, no third-party tracking cookies, analytics in local storage rather than cookies, and everything that is set is strictly necessary.

That page was last updated on 12 September. Plenty has shipped since. So I checked it the only way a claim like that can be checked, which is against a browser.

What one visit leaves behind

A signed-out visit to the homepage, read straight out of the console:

document . cookie . split ( ' ; ' ). map ( c => c . split ( ' = ' )[ 0 ]); // ['cp_country']

Object .…