Cookie information

02What is stored

Named individually, because a category is not a disclosure.

01soreo_session

The signed-in session. Set only after you sign in, HttpOnly, SameSite=Lax, and Secure wherever the deployment is served over https. Cleared when you sign out.

02soreo_csrf

A double-submit token that proves a request came from a page Tolavo served rather than from another site. Set alongside the session and cleared with it.

03soreo.visual.v3

A browser preference, in localStorage rather than a cookie, remembering whether you asked for the previous visual system with ?v3=0. It is not read by the server and never leaves your browser.

04tolavo.sidebar.more

A browser preference, in localStorage rather than a cookie, remembering whether you left the More group in the signed-in navigation open or closed. It is written only when you press More, it holds one of two words, open or closed, it is not read by the server, and it never leaves your browser.

05Offline copy

Kept in Cache Storage by Tolavo’s service worker, so a page you have opened before can still open without a connection, though without your data, which needs one. It holds the pages you open, each filed under its address without any query string and exactly as Tolavo’s server sends that address to every visitor (a page that answers with an error is not kept), and Tolavo’s own scripts, styles, fonts, icons and app manifest. Nothing from your account is in the pages it holds: your data arrives through the API, and the service worker never stores an API answer. The addresses they are filed under are kept with them, and the address of a proposal link includes that link’s token; an address stays after its link has been replaced, and opening the old link stores it again. A page’s copy is replaced each time that page loads from the network. Copies are not removed on their own: they stay until an update of Tolavo renames its offline cache, or until you clear this site’s data. It is not read by the server and never leaves your browser.

03What there is not

No analytics, no advertising, no cookie to ask about — and nothing sent to anyone but Tolavo.

Tolavo loads no analytics script and sets no advertising or measurement cookie. A consent banner exists to ask permission for exactly those things; there is nothing here to ask about, and a banner that asked anyway would be theatre. Nothing optional is set before it is chosen, because nothing optional is set at all.

There is no theme preference either. Tolavo has one theme, and it is light. A browser that still holds soreo.theme, the theme choice Tolavo used to offer, has it removed the next time it opens this page or the Tolavo app.

Nothing is sent to anyone but Tolavo. This page and every other public page are drawn entirely from Tolavo's own server: the four typefaces used to be fetched from Google's font hosts on every page load, which sent your IP address and your browser's user agent to Google before you had agreed to anything. Those files are now served by Tolavo itself, so the request is gone rather than disclosed, and this page's Content-Security-Policy no longer permits a font from anywhere but this server — if one were ever re-added, your browser would refuse it.