Cookie policy

1. Current application behaviour

The Fisemarco application code does not add advertising or analytics trackers and does not use localStorage or sessionStorage for tracking. No optional tracking category is enabled by this application. Our informational notice can be dismissed or reopened with Cookie settings. Dismissal is not consent to tracking.

Native account sign-in uses the first-party __Host-fisemarco_session cookie on HTTPS, with Secure, HttpOnly, SameSite=Lax and Path=/, without a Domain attribute. It contains a random opaque session value, not a password, passport, provider token or tracking identifier. Its maximum lifetime is 30 days; server-side sessions expire after 12 hours idle. Recovery-only sessions expire after 15 minutes. Sign-out invalidates the relevant application session immediately; changing a password invalidates all application sessions for that account. Local HTTP development uses the name fisemarco_session. This authentication cookie is necessary for protected features you request.

The hosting and sign-in layers can set cookies for sessions, authentication and security. Their production cookie names, domains and exact durations have not yet been inventoried for this notice. This is an outstanding disclosure, not a claim that all provider cookies are exempt or that this website is cookie-free. A production provider-cookie audit is required before the notice is finalised.

2. Purposes and consent

Cookies or equivalent device access strictly necessary to provide a service you request may be used without cookie consent under the applicable exception. Other device storage or access requires prior valid consent where the law requires it, even if a vendor describes it as functional or useful.

If optional analytics, advertising or embeds are introduced, they must remain disabled until the required choice is made. The choice must explain the providers, purposes and duration, provide a genuine rejection option, and allow withdrawal as easily as acceptance. Scrolling, silence and continued browsing are not consent. Accepting terms is not cookie consent.

3. Local processing and your controls

The first-party localStorage entry fisemarco.cookie-notice stores only this notice version and its expiry time, for 180 days after you dismiss the notice. Fisemarco OÜ uses it solely to remember your privacy-interface preference on this browser and origin. It is not sent to the server and contains no user or agent identifier. You can reopen Cookie settings at any time; clearing browser site data removes the preference. When storage is blocked, dismissal works for the current page but cannot be remembered.

The essential sessionStorage entry fisemarco:asset-recovery stores only a browser-local timestamp to limit recovery from a failed website script to one automatic reload per two minutes. It contains no user or agent identifier and is not sent to the server; it is cleared when the tab session ends or browser site data is cleared. The fresh-page recovery URL may contain a timestamp solely to avoid reusing a failed document. No tracking profile is created.

Camera access for QR scanning requires your browser permission. QR images and framework JSON are processed locally by the relevant feature, not uploaded by that feature. Downloaded exports and reports are files on your device and remain there until you delete them. Runtime SDK key files are stored by your own runtime host, not in a website cookie.

You can inspect and remove cookies using your browser's site-data controls, block third-party cookies, and revoke camera permission. Clearing authentication cookies may sign you out or interrupt protected features. Browser blocking controls do not replace the service's duty to obtain consent for non-essential storage. For provider-operated sign-in pages, review the notice shown by that provider.

4. Policy completion and updates

Before a personal-data pilot, record the actual cookie name, responsible provider, purpose, domain, expiry and consent category across anonymous browsing and sign-in. Publish that inventory here and implement consent controls if any non-essential cookies are found. Update this dated notice when device-storage behaviour changes.