Cookie and Local Storage Policy

Last updated: September 18, 2026

AHDRC uses first-party browser storage for authentication, security and user-requested preferences. AHDRC does not currently use analytics, advertising or behavioural-profiling cookies. Protected authentication forms also use Cloudflare Turnstile as a necessary anti-bot security service.

Cookie and local storage details
Name	Type	Provider	Purpose	Created when	Duration	Category	If cleared or blocked
__Host-AHDRC.Auth	Cookie	AHDRC first party	Authenticates signed-in members.	After successful login.	Browser session without Remember me; up to 14 days with Remember me.	Security / authentication	You are signed out or cannot remain signed in.
__Host-AHDRC.2FA.Pending	Cookie	AHDRC first party	Maintains a pending two-factor challenge after password verification.	When a 2FA-enabled account reaches the 2FA challenge.	5 minutes.	Security / authentication	The challenge cannot continue and you must sign in again.
__Host-AHDRC.2FA.RememberDevice	Cookie	AHDRC first party	Remembers a browser after a successful authenticator challenge when requested.	When you choose to remember the device.	Up to 14 days.	Security preference	You will be asked for a 2FA code again.
AHDRC.2FAReminderDeferred.[account hash]	Cookie	AHDRC first party	Remembers that a signed-in user chose to defer the optional 2FA reminder.	When "Not now" is selected.	Up to 14 days.	Security preference	The reminder may appear again.
__Host-AHDRC.Antiforgery	Cookie	AHDRC first party	Protects forms against cross-site request forgery.	When a protected form is rendered.	Browser session.	Security	Protected form submissions may fail.
__Host-AHDRC.Compare	Protected cookie	AHDRC first party	Stores up to four selected artwork IDs for the comparison workflow. It does not grant archive access.	When an authenticated user adds an artwork to comparison.	Up to 30 days.	Requested archive feature	Your comparison selection is cleared.
AHDRC.Culture	Cookie	AHDRC first party	Stores the selected site language.	When a language is selected.	Maximum 6 months.	Preference	The site returns to the default or URL-selected language.
AHDRC.Theme	Cookie	AHDRC first party	Provides the server with the saved light, dark or system appearance preference.	When an authenticated user saves an appearance preference.	Up to 1 year.	Preference	The server falls back to the default appearance until the preference is resolved again.
ahdrc-theme	Local storage	AHDRC first party	Applies the selected light, dark or system appearance before the page finishes loading.	When the appearance preference is resolved in the browser.	Until changed or browser storage is cleared.	Preference	The default appearance may be shown initially.
AHDRC.ProductTour	Cookie	AHDRC first party	Remembers completion of the versioned onboarding tour so it is not shown repeatedly.	When the product tour is completed.	Up to 10 years unless the tour version changes or the cookie is cleared.	Preference	The tour may be offered again.
AHDRC.NewSiteAnnouncement	Cookie	AHDRC first party	Remembers that the visitor has acknowledged the new-site transition notice.	When the visitor continues to the new site or chooses the old site.	Up to 1 year.	Preference	The transition notice may be shown again.
Cloudflare Turnstile challenge state and security signals	Embedded security processing; browser storage may be used by the challenge service	Cloudflare	Distinguishes legitimate users from automated traffic on Login, Registration and Forgot Password.	When one of those protected forms loads and a Turnstile challenge runs.	Controlled by Cloudflare for the security challenge.	Security / abuse prevention	The protected authentication form may not be usable.

Turnstile processes security signals including the client IP address, TLS fingerprint, User-Agent header, sitekey and associated origin. Cloudflare states that these signals are used for bot detection and blocking rather than to identify, profile or target individuals. See Cloudflare's Turnstile Privacy Addendum.

The comparison cookie is encrypted and authenticated with ASP.NET Core Data Protection and is HttpOnly, Secure, SameSite=Lax, essential and host/path scoped. Authentication, 2FA and antiforgery cookies are likewise configured with security-focused cookie attributes appropriate to their function.

AHDRC does not currently deploy analytics, advertising or behavioural-profiling storage. If optional tracking or analytics is introduced later, it must be assessed and, where required, blocked until the applicable consent mechanism is in place.

Cookie and Local Storage Policy

Storage details

Saved lists

Stay informed on new research and exciting news.