The rules, in plain language.

• Authentication/session state needed to keep signed-in users connected securely.
• Preference state such as theme, install mode, dismissed notices, and device-safe UI settings.
• Operational analytics and diagnostics used to improve reliability, performance, security, and launch readiness.
• Security and abuse-prevention markers such as rate-limit state for public Concierge usage.

Xoot must not store service-role keys, payment secrets, provider API keys, gate codes, alarm codes, lockbox codes, full card details, identity documents, or private support records in public browser storage.

You can clear browser cookies and site data from your browser settings. Clearing site data may sign you out, remove local preferences, and require re-authentication.

Mobile app sessions should use platform-secure storage where supported. Public web storage is not a place for server secrets or sensitive household access information.