Privacy notice

Cookies we set

We set one cookie, and only once you have signed in. It is called remidus_session. Its value is a long random token that means nothing outside our own systems: it carries no name, no email address, and nothing else about you. Its only job is to keep you signed in as you move between pages, so you are not sent back to Google on every request.

The cookie is marked HttpOnly, so scripts running in the page cannot read it, and SameSite=Lax, so your browser will not attach it to requests started by other websites. Over HTTPS it is also marked Secure. It is set for the whole of this domain, which is why signing in on one project signs you in across all of them. It expires 30 days after it is issued unless this site is configured otherwise, and your browser deletes it at that point.

On our side we do not keep the token. We store a one-way SHA-256 hash of it, so a copy of our database cannot be used to sign in as you. Stored alongside that hash are which account the session belongs to, when it was created, when it expires, and whether it has been revoked. The account record itself holds the email address, name, and profile picture address that Google gives us when you sign in, together with the time you were last seen. We also write the fact of each sign-in and sign-out, with the email address and a timestamp, to an administrative audit log.

Signing out revokes the session on our side and clears the cookie. You can also delete it in your browser whenever you like; the effect is the same, and you will simply be signed out.

This cookie is strictly necessary to provide a service you have asked for, so under the Privacy and Electronic Communications Regulations we do not need your consent to set it. We are still required to tell you that it exists and what it does, which is what this section is for. The personal data behind it — your account record and your sessions — is processed so that we can give you the account you asked for and keep it secure.

We set no other cookies. If a project ever needs one that is not strictly necessary, you will be asked first and your answer will be kept in a single remidus_consent cookie. No project uses one today.

How this site measures visits

Measuring visits uses no cookies at all, no local storage, and no persistent identifier. We never store your IP address. This happens whether or not you are signed in, and it is not connected to your account.

When you load a page, your browser sends us the page path, the origin of the site that referred you (not the full URL), rough viewport and screen size bands, your browser language, and the name of the event. On our side we derive a country and region from your IP address and then discard the address.

To count daily unique visitors we store a one-way hash of a rotating daily secret, your IP address, and your browser's user-agent string. The daily secret is held only in memory and is never written down, so once the day ends the hash cannot be linked to you or to your visits on any other day.

If your browser sends a Global Privacy Control or Do Not Track signal we drop the request entirely and record nothing.

Our lawful basis for measuring visits is legitimate interests: understanding which of our pages are useful, using the least data that can answer that question.

How long we keep things

A session and its cookie expire after the lifetime described above, and signing out ends them immediately. Your account record lasts as long as your access does. Visit measurements are deleted automatically once they pass the retention period set for this site.

TODO — human legal review required. This notice has been drafted by the build process to describe what the software actually does, including the stated cookie lifetime, which must be checked against the session lifetime this site is configured with. It has not been reviewed by a solicitor and must be before the site is public.