1. This website sets no cookie
This website sets no cookie, runs no third-party script, loads no font or image from another site, and has no analytics of its own. You can check this in your browser's developer tools: the list of cookies for this site is empty. The company that hosts the site may keep ordinary server logs, as any host does.
2. The dashboard uses only the cookies it needs
The dashboard is the application you sign in to. It is not this website.
- The dashboard signs a person in with an HttpOnly cookie protected by anti-forgery tokens, and is served from the same origin as the API.
- Its cookies are __Host-spoolstream.session (the session), __Host-spoolstream.2fa (the second-factor step, 5 minutes), __Host-spoolstream.reg (a registration in progress), __Host-spoolstream.ext (a sign-in with Google or Microsoft in progress), __Host-spoolstream.af and XSRF-TOKEN (anti-forgery), plus short-lived correlation and nonce cookies during a sign-in with Google or Microsoft. All but XSRF-TOKEN are HttpOnly; all are Secure, SameSite=Strict and limited to the dashboard's own host.
- A dashboard session ends after 8 hours without activity, and after 7 days at most.
- The dashboard remembers which organization is active in the browser's local storage.
These keep you signed in, protect your requests against forgery and remember the organization you work in. None is used to follow you, to measure an audience or to show advertising, and none is set by another company. Because they are strictly necessary to the service you asked for, the dashboard asks for no consent banner.
3. If this changes
If we ever add a cookie or a tool that measures visits, we will say so here first and ask for your consent before it runs.