Explanation
Why two origins
yearkeep.com is the public site. yearkeep.app is the product. Sessions do not cross.
Yearkeep ships as two origins on purpose.
| Origin | Job |
|---|---|
yearkeep.com |
Marketing, docs, legal. Prerendered HTML. Unknown paths 404. |
yearkeep.app |
The signed-in product / PWA. Today, capture, settings. |
Create your family and Sign in are absolute links to the product origin. This public site does not set a session cookie. It does not host a login form.
Why not one host
A marketing page that also holds a session mixes two threat models. A docs crawler should not receive a family cookie. A helper on a borrowed phone should not land on a blog layout. Splitting the hosts keeps the public origin static and the product origin authenticated.
If a link on this site sends you to signup, look at the host. It should be the app, not the site.