Where Your Browser Actually Stores Your Data

Every website you visit can store data on your machine in several compartments. Cookies are small values sent back to the server with every request — sessions, logins, tracking. localStorage is a roughly 5 MB per-site scratch space that never leaves your device unless a script sends it; it's how a notepad web app keeps your note through a restart with no account. The cache holds copies of images and scripts so repeat visits load fast. Larger apps use IndexedDB, a full structured database that can hold hundreds of megabytes.

The privacy geometry matters: cookies are built to travel to servers; localStorage and IndexedDB are built to stay. A tool that saves your work to localStorage is making a meaningfully different promise than one that syncs to a cloud — the data physically resides on your disk, scoped to that one site, invisible to other websites.

Closing a tab: everything survives except sessionStorage (a variant scoped to the tab). Restarting the browser or the computer: cookies with expiry dates, localStorage, and IndexedDB all persist — that's their job. 'Clear browsing data' is the nuclear option, and its checkboxes map to the compartments: 'cookies and site data' wipes cookies, localStorage, and IndexedDB (logging you out everywhere and deleting locally-saved work); 'cached images and files' only clears the cache and is safe for stored data.

The browser can also evict storage under disk pressure — rare on desktops, more common on phones — which is why anything genuinely important that lives in localStorage deserves an occasional export. A notepad's download-as-.txt button isn't decoration; it's the backup strategy.

You don't have to take any site's word for what it stores — the browser shows you everything.

Incognito or private mode gives the session a temporary set of compartments — cookies, localStorage, and history are discarded when the window closes. It's excellent for shared computers and for testing what a site looks like signed out. What it does not do: hide your traffic from the network. Your ISP, employer, school, and the sites themselves still see your visits; private mode changes what's remembered locally, not what's observable remotely.

The practical model: local storage privacy is about who else uses your device; network privacy is about who watches the wire. Browser storage controls handle the first. The second is a different toolbox — HTTPS, VPNs, and, more fundamentally, choosing tools that never transmit your data in the first place. A client-side tool has nothing to intercept.