Cookie Policy

**DRAFT — not legally reviewed.** Engineering draft prepared under QONTAI-121. The cookie inventory below reflects the codebase at the time of drafting and must be re-verified before publication.

1. What cookies are

Cookies are small text files stored in your browser by websites you visit. They let a site remember you across pages and visits. Similar mechanisms include `localStorage` and `sessionStorage`, which we cover here as well.

This policy explains what the QontaineR website uses, why, and how you can control them.

The QontaineR mobile app does not use browser cookies. In-app browser sessions opened to view legal pages may briefly use cookies from those pages only.

2. Categories we use

2.1 Strictly necessary

The qontainer_support cookie provides access to your private support inbox for up to seven days. Signing out of support removes this access. Email access links expire after 30 minutes and can be used once. Turnstile is loaded on support submission and access-request forms for spam prevention.

These cookies are required to run the Service securely. They cannot be turned off from within the Service.

| Name / mechanism                                     | Purpose                                             | Duration                                         |

| ---------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------ |

| Auth.js session cookie (e.g. `authjs.session-token`) | Keeps you signed in                                 | Session or persistent depending on "remember me" |

| Auth.js CSRF token (e.g. `authjs.csrf-token`)        | Prevents cross-site request forgery on auth actions | Session                                          |

| Auth.js callback URL (e.g. `authjs.callback-url`)    | Returns you to the correct page after sign-in       | Session                                          |

| MFA/email-OTP pending cookies                        | Completes a sign-in security challenge              | Short-lived; scoped to the challenge path        |

| `qontainer_cookie_consent`                           | Records your optional-storage choices and version   | 1 year                                           |

2.2 Functional

These remain off unless you enable “Remember preferences”. The controls still work for the current page when disabled, but the choice is not retained.

| Name / mechanism | Purpose | Duration || -------------------------- | ---------------------------------------------- | -------- || `theme` cookie | Remembers light/dark preference | 1 year || `sidebar_collapsed` cookie | Remembers whether the app sidebar is collapsed | 1 year |

2.3 Diagnostics

Sentry browser diagnostics remain off unless you enable “Diagnostics”. When enabled, Sentry may use browser storage to maintain masked error, performance, and logging context. Session replay is not sampled during ordinary sessions; a replay may be captured when Sentry records an error. Replay masks text and inputs and blocks media. Turning Diagnostics off clears known Sentry browser storage and prevents the browser SDK from initialising after reload. Server-side security and reliability logs do not depend on browser storage and are described in the Privacy Policy.

2.4 Browser feature flags

The LaunchDarkly browser client remains off unless you enable “Browser feature flags”. When enabled, it may use browser storage and contact LaunchDarkly to evaluate feature availability. Turning it off clears known LaunchDarkly browser storage and stops the browser client after reload. The server may still evaluate operational feature flags without storing data in your browser.

2.5 Advertising

We do **not** use advertising cookies. We do not participate in cross-site behavioural advertising.

3. Third-party cookies

The Service does not intentionally set third-party cookies. Where you sign in with Google or Apple, the sign-in flow briefly redirects to the provider, which sets its own cookies subject to its own privacy notice.

4. Controlling cookies

• **Cookie Settings** lets you accept, reject, or change each optional category at any time.

• **Signing out** invalidates your session. Expired authentication cookies may remain in the browser until removed by the application or browser.

• **Browser settings** let you block or delete cookies at any time — see your browser's help pages. Blocking strictly necessary cookies will prevent you from signing in.

• **Do Not Track / Global Privacy Control:** we do not sell personal data or use tracking cookies, so these signals have no effect on our current cookie use.

5. Consent

Optional storage and browser SDKs default to off. On your first visit we show controls to accept all optional categories, reject them, or customise them. Refusing optional storage does not prevent sign-in or core use of the Service. Changing a choice reloads the page so previously initialised SDK state cannot continue running.

6. Changes

Material changes will be posted here with a new version and last-updated date.

7. Contact

support@qontainer.app

Draft appendix — engineer notes (remove before publication)

• Re-verify cookie inventory against the live app immediately before publish. Auth.js cookie names may include the environment prefix (`__Secure-` in production).

• Re-test consent withdrawal against Sentry and LaunchDarkly whenever either SDK is upgraded.