Cookie and Local Storage Notice

The pilot uses an HttpOnly session cookie to authenticate requests. It is inaccessible to ordinary page scripts, expires after seven days and is cleared when logout succeeds. Production transport requires HTTPS and the cookie is restricted by its configured SameSite policy.

The browser also stores a display copy of the user’s identifier, email and role in local storage. These values do not grant API permissions; the server checks the session and current role independently. Logout clears the display cache. Sandbox checkout uses session storage for a retry identifier, not card details.

No advertising or optional analytics integration was found in the inspected application. Hosting infrastructure and security providers may process technical request data under their own arrangements; this must be included in the final processor review.

Before introducing optional tracking, inventory its purpose, providers and retention, implement any required consent controls, and offer withdrawal as easily as acceptance. Browser settings can remove stored data, which may sign the user out.