Cookies
Cookies
Effective September 22, 2026. Essential cookies only. This is not legal advice. Counsel should review it before you rely on it for a regulated market.
What we use
Living Well (Luminosity Development LLC) sets only cookies the product needs to sign you in and to stay on one Azure App Service instance. We do not use advertising cookies, analytics cookies, or other trackers. Because these cookies are essential, the site does not show a consent banner.
On https://getlivingwell.com the Auth.js names below use the __Host- and __Secure- prefixes, because the site is HTTPS. The app does not configure custom cookie names. A local HTTP preview uses the same cookies without those prefixes.
Cookie names
| Name | Why it is set |
|---|---|
| __Host-authjs.csrf-token | Auth.js. Protects sign-in against cross-site request forgery. Set on the HTTPS site when you use sign-in. |
| __Secure-authjs.callback-url | Auth.js. Remembers which page to open after you sign in. |
| __Secure-authjs.session-token | Auth.js session while you are signed in. This app uses JSON Web Token sessions and does not rename this cookie. If the token is large, Auth.js splits it into numbered cookies: __Secure-authjs.session-token.0, .1, and so on. |
| __Secure-authjs.pkce.code_verifier | Auth.js. Short-lived (about 15 minutes). Set only while a Microsoft sign-in is in progress. |
| __Secure-authjs.state | Auth.js. Short-lived (about 15 minutes). Set only while a Microsoft sign-in is in progress. |
| __Secure-authjs.nonce | Auth.js. Set only while a Microsoft sign-in is in progress. |
| ARRAffinity | Azure App Service. Keeps your browser on the same app instance so load balancing does not bounce the session. |
| ARRAffinitySameSite | Azure App Service. The same load-balancing affinity cookie, with a SameSite attribute. |
Auth.js cookies are first-party, HttpOnly, SameSite=Lax, and (on this HTTPS site) Secure. Blocking them will break sign-in. Blocking the Azure affinity cookies can make the site fail to stick to one instance.
Not a cookie
The public intention candle remembers a style choice in local storage on this browser (leaving-well.candle.style). That value stays on the device. It is not a cookie and it is not sent to the server.
More about the information we store is in the Privacy Policy. Using the service is covered by the Terms of Use.