# Does Croct set any cookies at all out of the box?

Asked by Matthias Egger on 2025-09-03. Tags: privacy, cookies, storage.

I am completing a vendor privacy assessment and the form requires me to document
exactly what is stored client-side, under which name, and for how long. Vague
answers do not pass review here.

For a default Croct installation, no special configuration:

1. Is anything written to cookies, or is it localStorage only?
2. Under which configurations do cookies appear, and with which names and
   lifetimes?
3. Can every cookie attribute (domain, maxAge, sameSite and so on) be declared
   explicitly, so I can put exact values in the assessment?

I need this precise enough to survive an auditor reading it line by line

## 1 answer

### Accepted answer from pieter_vd (2025-09-03)

Went through the same exercise for our assessment last quarter, so here are
the exact answers.

1. Default storage is localStorage, origin-scoped. A default installation sets
   no cookies, and no third-party cookies are involved in targeting under any
   configuration.

2. Cookies appear only when you configure them. The main case is
   cross-subdomain identity, where storage moves to first-party cookies:
   `croct.id` for the client ID and `croct.user_token` for the user token,
   with a typical maxAge of 1 year. Separately, the Next.js SDK manages its
   own first-party cookies: `ct.client_id`, `ct.user_token`, and
   `ct.preview_token`.

3. Yes. The plug `cookie` option controls name, secure, maxAge, domain, path,
   and sameSite per cookie, so the entire storage posture is declarable in
   your assessment with exact values rather than defaults you have to reverse
   engineer.

If the subdomain case is relevant to your setup, there is a thread on
[sharing identity across subdomains when the default is localStorage](/answers/localstorage-vs-cookies-subdomains)
with the configuration details.

#### Reply from Matthias Egger (2025-09-04)

This maps one-to-one onto the assessment form fields. Documented as
localStorage-only for our single-domain setup, with the cookie
configuration noted as not applicable. Thank you for the precision.