One session cookie and a locally saved draft.

The essential session keeps interactive requests connected

The server cookie is named __Host-pixelforged_session. It contains a random session identifier and expiry inside a signed value. The cookie is marked Secure, HttpOnly, SameSite=Lax, and Path=/, with a maximum age of thirty days. JavaScript running in the page cannot read an HttpOnly cookie.

The session connects requests to anonymous-draft limits, email verification, revision credits, rate controls, saved-draft validation, and short request locks. It is not an advertising identifier in the application code. Removing it can create a new session and can disconnect a saved draft from prior verification, remaining revisions, or the server signature needed to restore it.

Name

__Host-pixelforged_session

Purpose

Session continuity, abuse prevention, feature limits, verification, revision credits, and draft validation.

Maximum age

Thirty days in current server code.

Browser access

Secure, HttpOnly, SameSite=Lax, and available across the site path.

Website Draft Bot saves work in this browser

Website Draft Bot first tries localStorage under the key pixelforged:draft-bot:v1. If localStorage is unavailable, it can fall back to sessionStorage. Saved state can include the current step, five answers, starting color, generated HTML and CSS, palette, labeled stand-ins, summary, server signature, verification status, remaining revision count, and selected view.

The saved record does not include the verification email address or six-digit code. A restored draft is not trusted just because it exists in the browser. The client sends the draft and signature to the server, where the signature is checked and the draft is sanitized again. Changed, invalid, or expired state is rejected rather than treated as a trusted draft.

You can remove saved work from the Draft Bot

The Clear Saved Draft button removes the pixelforged:draft-bot:v1 record from the browser storage in use. It also clears the visible answers, generated draft, signature, palette, verification state, and revision count held by the open page. Browser settings can also remove cookies and site data for pixelforged.com.

A localStorage record has no separate calendar expiry. It can remain until you clear it, browser settings remove it, the browser evicts it, or the application rejects invalid state. sessionStorage normally lasts for the browser session, subject to browser behavior. Clearing local data does not delete email already delivered or provider records held outside the browser.

Rate and quota records are not browser cookies

The server uses Upstash Redis for rate limits, anonymous-draft allowances, verification records, revision credits, and short request locks. Records can be associated with the random session identifier, a keyed pseudonymous coarse-network value, or a keyed pseudonymous email value. The browser does not store those Redis records as cookies.

Current code gives the anonymous-draft session record thirty days, the coarse network allowance up to twenty-four hours, a verification code ten minutes, and verified email hash and revision-credit metadata up to ninety days. Feature rate counters and request locks expire sooner. Provider logs and backups can follow different schedules that website source code does not establish.

Some features contact service providers

Public pages request styles and font files from Google Fonts. Interactive features use PixelForged API routes hosted by Vercel. Those routes can use Upstash, Resend, Vercel AI Gateway, and an AI model provider for their stated jobs. External work links lead to independent websites with their own storage practices.

No advertising pixel, analytics library, behavioral replay tool, social tracking tag, or advertising preference center appears in the reviewed application source. That is a current-code observation, not a promise about future features or provider-level network behavior. A new analytics, scheduling, payment, video, map, portal, or embedded service could change what the browser sends or stores.

Browser settings can block or remove site data

Most browsers let you view, block, or delete cookies and site data. Blocking all storage can stop bot continuity, saved drafts, verification, or revision credits from working as designed. Static pages should remain readable, but an interactive action may receive a fresh session each time or fail to restore prior work.

Use Clear Saved Draft when you want to remove Draft Bot work while keeping other site data. Use browser settings when you want to remove the session cookie and all browser storage for the site. If PixelForged adds a new feature that changes storage behavior, this page should be revised before the new description is relied on.