LMS
Learning Management System
Legal & trust
Legal · Storage inventory

Cookie and Browser Storage Policy — Draft

A plain inventory of storage the repository uses today, with unknown production details left visibly unconfirmed.

Confirmed from codeInferred — requires confirmation
Last updated: Runtime capture still requiredInferred — requires confirmation
On this page6 entries
Plain-language overview

Read this first

The development build needs authentication cookies and remembers one sidebar preference. It contains no third-party analytics or advertising SDK.

Confirmed from code

Sign-in needs cookies

Auth.js session storage is required to keep users signed in and protect private routes.

Confirmed from code

One local preference

The portal remembers only whether its navigation rail is open or collapsed.

Confirmed from code

Production details unknown

Names, attributes, rotation, and expiry need a real deployed-browser capture.

Inferred — requires confirmation
Repository evidence

How to read these drafts

Each factual or decision-bearing statement shows whether it is proven today, inferred and awaiting confirmation, missing from the product, or reserved for a human decision.

  • Confirmed from code
  • Confirmed from configuration
  • Inferred — requires confirmation
  • Missing implementation
  • Business/legal decision required
Inferred — requires confirmationBusiness/legal decision requiredThis draft is not legal advice and is not ready for publication. No duration, consent rule, or production cookie property is promised until runtime and jurisdiction review are complete.

Operator details required

Business/legal decision required

This draft requires [COMPANY LEGAL NAME], [PRODUCT NAME], [COOKIE CONTACT], and [POLICY EFFECTIVE DATE] before approval.

1Current cookies and browser storage

Confirmed from code

Auth.js JWT session cookie(s) maintain sign-in and carry session identity and claims used by protected routes. Disabling them prevents authenticated LMS access.

Inferred — requires confirmation

Auth.js may also emit short-lived authentication-flow cookies for state or framework protections. The exact set and duration require deployed runtime capture.

Inferred — requires confirmation

Exact cookie names, attributes, and lifetime need a deployed runtime capture. Secure, HttpOnly, SameSite, path, domain, rotation, and expiry behavior are not explicitly fixed in repository configuration.

Confirmed from code

The eduflow-rail local-storage item remembers whether the signed-in portal rail is open or collapsed. It remains until overwritten or browser storage is cleared.

Confirmed from code

No external analytics, advertising, pixel, or cross-site tracking SDK was found.

2Contact-form behavior

Confirmed from code

The demo contact form validates typed name, institution, work email, and role in the browser, then prevents submission and resets. Application code does not transmit or store those values; browser autofill remains controlled by the user and browser.

3Browser controls

Confirmed from code

Clearing the sidebar preference changes only the remembered interface state; it does not delete an account or academic record.

Inferred — requires confirmation

Browsers can block or clear cookies and local storage, but exact controls differ by browser and device.

Missing implementation

No cookie banner, consent record, preference center, analytics opt-out, or consent-withdrawal mechanism is implemented.

Business/legal decision required

[LEGAL REVIEW REQUIRED] Decide whether the functional local-storage preference needs consent and whether a banner is required after jurisdictions and production behavior are confirmed.

Business/legal decision required

Do not add non-essential analytics, advertising, replay, personalization, or third-party embeds until purpose, provider, data, duration, legal basis or consent, and withdrawal behavior are approved and documented.

5Production verification required

Missing implementation

Capture all cookies and storage before sign-in, during sign-in, while authenticated, after sign-out, and after password change on the deployed domain.

Missing implementation

Record each name, owner, purpose, content category, path/domain, security attributes, creation, rotation, and expiry behavior; then test sign-out and password-change session invalidation.