What this page is
A cookie list for amo.watch, area.amo.watch, and app.amo.watch. Read it with Riservatezza (what we store on the server) and Termini (the contract).
We use cookies that are required to sign you in, keep a cart, and stop CSRF on Area. We do not use advertising cookies. Public WordPress pages load Yandex Metrika (counter 112317402) after the page is idle. Area and the app do not load it.
How Amo uses cookies
Production Area sets the session on domain .amo.watch so app.amo.watch can see the same login. The app host asks Area whether that cookie is entitled. The player in the browser does not decide the subscription.
The session cookie is HttpOnly and Secure, SameSite=Lax. JavaScript on the page cannot read it. The CSRF cookie is readable so the Area UI can send `X-CSRF-Token` on POST. The CSRF cookie alone is not enough to change anything.
Default lifetime is up to 8,760 hours (one year). While you keep using Area or the app, expiry slides forward. Sign-out or revoke deletes the session row and clears both cookies.
Cookies we set
Names can gain a WordPress prefix on checkout. Durations are typical, not a stopwatch.
| Name | Where | Purpose | Lasts | Type |
|---|---|---|---|---|
amo_area_sid | .amo.watch | Opaque Area session. Lets Area and the app know who you are. HttpOnly, Secure, SameSite=Lax. | Up to 1 year, sliding | Essential |
amo_area_csrf | .amo.watch | CSRF token for Area POST/PATCH. Not HttpOnly. Must match the session. Cookie alone cannot change the account. | Same as session | Essential |
wordpress_test_cookie | amo.watch | WordPress checks the browser accepts cookies before checkout. | Session | Essential |
wordpress_logged_in_* | amo.watch | WooCommerce maps the Area session to a customer on amo.watch so guest checkout stays off. | Session | Essential |
woocommerce_cart_hash | amo.watch | Hash of the cart so the plan you picked survives a hop from Area login. | Session | Essential |
woocommerce_items_in_cart | amo.watch | Whether the cart has a plan in it. | Session | Essential |
wp_woocommerce_session_* | amo.watch | WooCommerce session for cart and checkout. Not an Amo entitlement. | About 48 hours | Essential |
amo_ref | .amo.watch | Referral code from a shared /r/ link so Area can credit the member who invited you. HttpOnly, Secure, SameSite=Lax. Not advertising. | 24 hours | Essential |
amo_utm | .amo.watch | First-touch source (utm and referrer host) so Area can show how a member found Amo. Not an advertising pixel. | 30 days | Essential |
_ym_uid | amo.watch | Yandex Metrika unique visitor id. WordPress public pages only. | About 1 year | Analytics |
_ym_d | amo.watch | Yandex Metrika first-visit date. | About 1 year | Analytics |
_ym_isad | amo.watch | Yandex Metrika flag for whether a content blocker hid the tag. | About 2 days | Analytics |
_ym_visorc_* | amo.watch | Yandex Metrika Webvisor session. Marketing pages only, not checkout. | Session | Analytics |
Cookies we do not control
Cloudflare sits in front of public HTTPS. It may set bot-management or challenge cookies (__cf_bm, cf_clearance) on its own terms. We do not use those for advertising.
Google sign-in runs on Google’s domains. Facebook sign-in runs on Facebook’s domains. Telegram Login runs on oauth.telegram.org. YouTube trailer embeds (youtube-nocookie where we can) may set cookies on Google’s domains if you press play on a trailer. Catalog artwork is TMDB, requested by our server, not a TMDB cookie in your browser.
Official Amo apps and Lampa clients store some player prefs on the device and sync a subset into Area. That is account data, not a web cookie. See Privacy.
What we do not set
- No advertising cookies.
- No Google Analytics, Meta Pixel, or Hotjar from the Amo theme. WordPress uses Yandex Metrika only.
- No "remember the card" cookie from Amo. Card details, if any, stay with the payment processor.
How to control cookies
Sign out on Area to revoke the session and clear `amo_area_sid` / `amo_area_csrf`. Blocking all cookies will break login, TV pairing, and checkout. Those cookies are the product, not a tracker we can switch off and still sign you in.
A content blocker that hides mc.yandex.ru stops Metrika. Login, checkout, and the app still work. Browser controls can also delete _ym_ cookies.
Browser controls can delete cookies for amo.watch. After that you will need to sign in again. Questions: [email protected].