Sessions, tokens and signing out

Website sessions

Signing in on slopsquash.com stores a session token in the browser's local storage under slopsquash.session and sends it to the API as a bearer token; no cookie is involved. A session lasts 14 days. Sign out on the account page deletes the session on our side and removes the token from the browser.

Sessions are per origin. Signing in on slopsquash.com does not sign you in on affiliate.slopsquash.com, and vice versa; sign in on the host you are using.

Extension tokens

The extension has its own token, issued by the connect page, lasting 90 days and stored inside the extension. Each browser you connect gets one. Sign out from the popup to remove it; uninstalling removes it too.

Ending every session at once

Deleting your account removes every session and extension token. Changing your password does not by itself end sessions on other devices, so if you think someone else has your account, sign out where you can and email support@slopsquash.com.

Shared computers

Anyone with access to a browser profile where you are signed in, or where the extension is connected, can use Slop Squash as you. Sign out of both on shared machines.