If you choose to stay logged in, a browser cookie will hold a token. Don't do that on a shared device.