This demo uses an HTTP-only signed session cookie. Refreshing clears the in-memory app state (basket, uploads, preview), but the session cookie may remain until it expires or you logout.