The browser stores the cookies, so if it is a system browser then the system browser stores the cookies even if embedded in the app. It also means that the app isn’t likely aware of those cookies as it’s part of a separate app.

Also, generally speaking, few developers want to build their own browser. It is far easier to just ask the OS to put a browser in a space provided by the app, than to build a browser that works well to be used on the greater internet and the actual app itself. I say this because “the browser stores the cookies” so if app xyz doesn’t use a system browser then app xyz is the browser. Like, any app can ask you for your reddit username and password, store that, make HTTP calls that login with your username and password, parse the HTML it gets from reddit, and report it back to you. This is essentially how lemmy apps work at a high level with one big difference: these apps and the server are both aware of each other, which is the same sort of situation where a company like google or reddit gives API access as a sort of contract between how the apps and servers with better security and full consent of all involved.

Basically if you see reddit apps pop up which don’t use the official API, you should be wary. Doubtful they would make it onto the app stores but it’s always possible. It doesn’t mean they are nefarious, just that they could be.

The good news is it’s pretty easy to tell what you are using.

Logged into example.com somewhere on your device, then you open a freshly installed app, click a link to example.com and you are already logged in? System browser.

Logged into example.com somewhere on your device, then you open a freshly installed app, click a link to example.com and you aren’t logged in? This could be another browser if you have more than one installed on your device. So the ask… does it look and function like shit? This isn’t a great test but again, building a browser that actually renders html css and js is difficult, so it’s likely to not work or look very well if it’s something built with the purpose of stealing data specifically.