Cookie policy

Cookies and local storage

Cookies and local storage are small pieces of data that a website asks your browser to keep. They stay on your device until they expire or you delete them.

What this service stores, and why

Only what the service needs to run, each for the purpose named. Nothing here identifies you to anyone else, nothing is set by a third party, and nothing is used to measure or track you.

• —authjs.session-token (over HTTPS: __Secure-authjs.session-token), a cookie. Keeps you signed in between pages. Lasts: Up to 30 days, or until you sign out.
• —authjs.csrf-token (over HTTPS: __Host-authjs.csrf-token), a cookie. Stops another website from submitting a form on your behalf. Lasts: Until you close the browser.
• —authjs.callback-url (over HTTPS: __Secure-authjs.callback-url), a cookie. Remembers which page to return you to after you sign in. Lasts: Until you close the browser.
• —invite-arrival, a cookie. Marks that you have just joined an organisation by invitation, so the dashboard can confirm which one and your role. It carries no data. Lasts: At most 15 minutes, and removed when you dismiss the confirmation.
• —stealth_pw_changed, a cookie. Lets the sign-in page tell you that your password was changed. It carries no data. Lasts: 2 minutes.
• —cookie-notice.v1, a local storage. Remembers that you acknowledged the cookie notice: its version and the time. It is never sent to the server. Lasts: Until you clear your browser storage, or the notice version changes.

Server-side records

The service also keeps records on its own servers. They exist for security and operation, they do not depend on the cookie notice, and clearing your browser does not remove them. The privacy policy says what is kept and for how long.

• —Sign-in events and audit records: Security, and recovering an account.
• —Server logs: Operating the service; kept for a short operational window.

The notice and your browser controls

Selecting “Understood” only records that you have read the notice, and closes it. It is not consent, because nothing here needs consent. There are no tracking preferences to set, because there is no tracking.

Your browser can show, block or delete cookies and local storage. Blocking the sign-in cookie stops sign-in from working.

Updates

This policy was last updated on the date shown at the top of the page. A material change to what the service stores moves that date and shows the cookie notice again.

Contact

Write to the contact address in the imprint for anything on this page. It reaches a person, not a queue.