Memory-only cookies are the safer default, but they also forget logins and site preferences you might want kept. ☰ → Settings → Privacy & security → Cookie exceptions… lets you list sites that are exempt — add a bare host like youtube.com (subdomains included), localhost, or an IP address.

  • Anything not on the list is unchanged: memory-only, erased on exit.
  • Listed sites' cookies are mirrored to disk and restored the next time you start Vodou.
  • Encrypted at rest using your operating system's own keystore (Windows DPAPI, or your desktop keyring on Linux) — there's no password prompt, and no other local account on the machine can read it.
  • If no keystore is available at all, this feature quietly switches itself off rather than storing anything unencrypted — the dialog tells you when this happens.
  • Only genuinely persistent cookies are kept; cookies a site itself marks as session-only are never saved.

A site's login cookie often actually lives on a parent or sibling domain — YouTube's, for example, lives on google.com — so keeping one site signed in can take more than one entry in the list.

Ctrl+Shift+Del empties the saved cookie jar too. The exception list itself survives; only the stored cookies are wiped.