Draft. This document is an operational placeholder pending counsel review. It is published so users and regulators can see the structure of our data-protection and contractual commitments; the finalised wording will be issued before any production-grade rollout.

Cookie & Storage Notice

Version 0.4-draft · Effective 2026-08-14

DefenceOS uses browser storage only to deliver functionality you have requested. No analytics cookies, advertising identifiers, or third-party trackers are set. Under the ePrivacy Directive (2002/58/EC, Article 5(3)), such strictly-necessary storage does not require prior consent, but we document it here for transparency.

What we store

Session (dos_session) — an opaque, HttpOnly, Secure, SameSite=Strict cookie set by the backend engine when you sign in. Not readable from JavaScript. Referenced from a server-side session store; signing out invalidates it server-side. This replaced the earlier pilot-era localStorage shim.
Sidebar state (sidebar:state) — a cookie that remembers whether you prefer the navigation expanded or collapsed. Expires after seven days.
Cookie-notice dismissal — a localStorage flag recording that you have seen this notice, so we do not show it again.
Demo-banner dismissal (defenceos:demo_banner_dismissed) — a localStorage flag recording that you have dismissed the non-production-data notice.
Last-onboarded VAT (defenceos_last_onboarded_vat) — a localStorage value used to pre-fill the onboarding flow if you return after submission.
Data-ops role preference (per VAT) — a localStoragevalue remembering the last role you used inside the data-operations workspace on this browser. Never sent to the backend; a UI preference only.

Delete any of the localStorage entries at any time by clearing site data in your browser. On sign-in, the app also actively erases the pre-migrationdefenceos_auth_user key from any browser that still has it, as a defence-in-depth cleanup.

Third parties

Web fonts (DM Sans, Geist Mono) are served directly from DefenceOS. No requests are made to Google Fonts or other third-party content delivery networks. The only external endpoints contacted from the browser are those on the same origin as the application.

Google Search Console. The site root carries a<meta name="google-site-verification"> tag that lets us verify domain ownership in Google Search Console. This tag does not set a cookie, does not load JavaScript, and does not cause any request from your browser to Google — it is a static string that Google's server-side crawler (Googlebot) checks when it visits the site. The Search Console service itself gives Skansar aggregated search-analytics data (queries, impressions, clicks) that Google would collect regardless of whether the property was verified. See the Privacy Notice, Section 4, for the sub-processor disclosure.

Your control

You can clear all DefenceOS storage at any time from your browser's site-data settings. Clearing storage will sign you out and reset UI preferences.

Contact

Data-protection questions can be directed to dpo@skansar.com.

Changes

2026-08-14 (v0.4-draft) — added the Google Search Console disclosure under “Third parties” alongside the site-verification meta tag going live. The tag sets no cookie and initiates no browser-side request.
2026-08-08 (v0.3-draft) — replaced the placeholder session description with the shipped dos_session HttpOnly + Secure + SameSite=Strict cookie and its server-side session store. Added the demo-banner and data-ops role localStorage entries that were not previously listed. Noted the automatic erase of the pre-migration defenceos_auth_user key.
2026-04-22 (v0.1-draft) — initial notice.