Cookies
Three cookies, all of them needed to sign in, none for advertising.
Last updated
The ones that are set
This page used to say the site set no cookies. That was true when there was no way to sign in. There are accounts now, and a session needs a cookie:
- `avora_admin_session` — your session. It holds a random identifier only; the server keeps nothing but its digest, so even a copy of the database would not let anybody sign in with it. JavaScript cannot read it and it expires on its own.
- `avora_mfa_challenge` — alive for a few minutes between the password and the verification code, and gone as soon as you are in.
- `avora_view_as` — set only while a member of staff is viewing an account with authorisation, and the application says so on screen the whole time it exists.
The ones that are not
No analytics, no advertising, none from third parties. Which is why there is still no consent banner: the three above are strictly necessary for you to sign in, and a banner asking permission to keep your session open would be theatre.
Browser storage
A couple of small values are also kept in your own browser storage — the palette you chose, little else. They are transmitted nowhere and disappear when you clear the site's data.