Cookie policy

1. Authentication cookies

sme_access and sme_refresh maintain the authenticated session and refresh flow. They are HttpOnly, use SameSite=Lax and use the Secure attribute when configured for HTTPS production. Their expiration is set by backend deployment configuration.

sme_session_marker identifies the current authenticated session so the page can tell when it changes. It is not HttpOnly, uses SameSite=Lax and uses the Secure attribute when configured for HTTPS production. Its expiration is set by backend deployment configuration.

2. Google authorization

sme_google_oauth_state is used during the configured Google sign-in flow to protect authorization state. It is temporary and cleared during callback handling. Google may use its own cookies on its own site under its policies.

3. Preferences and local storage

sme-locale remembers the language choice. The app can store interface preferences such as theme and navigation state locally in your browser. Clearing browser storage resets these preferences and may sign you out.

4. Analytics and choices

The current marketing implementation does not include external analytics or advertising trackers. There is no non-essential analytics toggle that secretly enables tracking. Any future tracking integration requires a reviewed policy and applicable consent controls before activation. This policy version is a draft.