Cookie Policy

The accessToken cookie holds a short-lived sign-in token and expires after 15 minutes. The refreshToken cookie supports session renewal and expires after 7 days. Both are configured as HttpOnly, SameSite=Lax cookies with the site root as their path. The Secure flag is enabled in production.

These cookies are set when a person signs in. Signing out clears them. Blocking these cookies prevents the application from maintaining a signed-in session.

The current analytics implementation records event details such as the page URL, referrer, IP address, and browser user-agent through server requests. The reviewed application code does not set an analytics cookie for this tracking.

Cookie behavior can change when the application or its integrations change. The service operator should update this policy if new cookies or third-party services are introduced.

This draft does not identify every cookie that a production deployment or third-party integration may set. Verify the deployed site and complete a legal review before publication.