Cookies and local storage
Effective date: [REQUIRED]. We use necessary browser storage for email-code authentication, account sessions and Matrix end-to-end encryption keys/device state where the user uses chat. Some data is held in IndexedDB or local storage rather than cookies. Removing browser data can sign you out or make older encrypted messages unavailable. The current development client has no key-recovery flow.
Essential technologies
reference_sessionHttpOnly account cookie: sign-in and access control; expires after 30 days, with SameSite=Lax and the Secure attribute in production.- Request origin checks on state-changing application requests; the current app does not set a separate CSRF cookie.
- Language selection is held in the account record and/or page URL; the current app does not set a locale cookie.
- Matrix E2EE device/crypto key state is held in IndexedDB. The browser also keeps its Matrix device credentials in local storage under an account-specific key. Clearing either store may prevent old messages from being decrypted.
These technologies are essential for functions a user requests or for secure operation, subject to applicable ePrivacy rules.
Optional cookies and trackers
None by default. We do not load non-essential analytics, advertising pixels, behavioral advertising or social tracking SDKs. If introduced later, document each processor, cookie name, purpose, expiry and country and provide genuine opt-in and rejection controls before activation where legally required. Third-party embedded content must not silently set nonessential trackers.
Your controls
You may clear cookies or site data in your browser and contact contact@pharmspan.com. Clearing Matrix storage may permanently prevent you from reading earlier encrypted messages in this development client; there is no recovery-key export here yet. Privacy notice explains related personal-data processing.