Cookies and storage
Draft for legal review. Not yet in force.
ROCC Tracker only stores what it needs to work. It doesn't use advertising or analytics cookies, so there's nothing to opt in to.
| Where | What | Why | How long |
|---|---|---|---|
| Admin | Session cookie (__Host-tracker_session) | Keeps you signed in. Strictly necessary. | 30 days, or until you sign out |
| Admin, signing in with Microsoft | A sign-in cookie (__Host-tracker_ms_flow), and when signing up a sign-up cookie (__Host-tracker_ms_signup) | Checks that Microsoft's answer is for the sign-in you started, and remembers who Microsoft said you are while you name your organisation. Strictly necessary. | 10 minutes; the sign-up cookie 30 minutes |
| Platform console (ROCC staff) | Session cookie (__Host-tracker_staff), and while signing in with Microsoft a sign-in cookie (__Host-tracker_staff_flow) | Keeps you signed in, and checks that Microsoft's answer is for the sign-in you started. Strictly necessary. | 12 hours, or until you sign out; the sign-in cookie 10 minutes |
| Customer tracking page | Nothing, unless you turn on notifications. Then the browser keeps a service worker and a notification subscription. | Shows "on the way", "nearly there" and "arrived" notifications you asked for | The subscription is deleted from Tracker when the visit ends; the service worker stays until you clear site data |
| Operative share-location page | Nothing | ||
| Tracker app | Sign-in token, server address and any journey in progress, in the phone's secure storage | Keeps you signed in and resumes a journey after the app restarts | Until you sign out |
| Documentation website | Your light or dark theme choice and dismissed notices, in the browser's local storage | Remembers choices you made | Until you clear your browser data |
The hosting provider may set a short-lived security cookie to protect against attacks. That is strictly necessary.