Cookies and local storage

Two things are stored in your browser by Spotreach. Both are listed below in full. There is no third item, and no banner asking you to accept one.

The session cookie

Set when you log in to the panel at app.spotreach.net. It is what keeps you signed in from one page to the next.

• Name: session
• Contents: your tenant id and a CSRF token, signed by us. Your account key is never in it, so a stolen cookie does not hand over the key.
• Flags: HttpOnly so page scripts cannot read it, SameSite=Lax so it is not sent with requests started by other sites, and Secure so it never travels over plain HTTP.
• Lifetime: 14 days, or until you log out.
• Set by: us. It is a first-party cookie and it is never shared.

The theme preference

If you switch the interface between light and dark, that choice is written to your browser's local storage so the next page does not flash back to the other theme.

• Key: sr-tema, value light or dark
• Where it lives: your browser only. It is never sent to our servers, so we do not know which theme you use.
• If you never touch the switch nothing is written at all and the interface follows your operating system setting.

What we do not set

• No analytics of any kind. We do not run Google Analytics, Plausible, or an equivalent, on this site or in the panel.
• No advertising or retargeting pixels, and no conversion tags.
• No third-party cookies. Nothing on these pages is loaded from another company's domain: the fonts, styles, scripts and images are all served from us.
• No fingerprinting, no cross-site identifiers, no session recording, no heatmaps.

Why there is no consent banner

Under the EU ePrivacy rules and the UK PECR equivalent, consent is required before storing anything on your device unless it is strictly necessary to provide the service you asked for, or you set it yourself. A login cookie is the first case. A theme switch you clicked is the second.

We do not set anything outside those two, so there is nothing to ask you about. A banner here would be theatre: it would ask permission for tracking that does not happen. If that ever changes we will put the choice in front of you before the first new cookie is written, not after.

Removing them

Logging out ends the session and drops the cookie. Clearing site data for this domain in your browser removes both items; the interface then goes back to following your system setting. Blocking cookies entirely still lets you read this site, but the panel cannot keep you logged in.