Cookie Policy
Contextator sets exactly one cookie, and only after you sign in. It carries no personal data and no identifier that follows you anywhere: it names your session on this server and nothing else. There is no analytics cookie, no advertising cookie and no third-party cookie. That is why you are not asked to consent — a strictly necessary cookie does not need consent, and there is nothing else here to ask about.
1. The cookie
| Name | Purpose | Lifetime | Category |
|---|---|---|---|
contextator_session |
Keeps you signed in. Its value is a random, opaque session id — not your name, not your password, nothing
derived from them. It is HttpOnly (no script on the page can read it), SameSite=Lax
(browsers do not attach it to requests started by another site) and Secure whenever the instance
is served over HTTPS.
|
Until you sign out, twelve hours after you stop using the dashboard, or thirty days at the outside — whichever comes first. It is refreshed while you keep working. The operator can shorten both. | Strictly necessary |
There is no second cookie for cross-site request forgery. The dashboard is served from the same origin as the API, the
cookie is SameSite=Lax, and the server additionally checks that a request which changes something really
came from a page on this site. A hidden token cookie would add nothing to that.
2. What is no longer used
Earlier versions of Contextator had no accounts: they were protected, if at all, by a single shared admin token, and
the dashboard kept that token in this browser's localStorage under the key
contextator_admin_token. That mechanism is gone. You now sign in with an account of your own, and the
dashboard deletes the leftover key the first time it loads. Clearing site data removes it too.
ADMIN_TOKEN still exists on the server as a way for scripts and CI to reach the API, but it is a
server-side credential now: it is never stored in, or typed into, a browser.
3. How to remove it
Sign out from the menu in the top right. The cookie is deleted and the session is destroyed on the server as well, so the id in it stops meaning anything even if someone kept a copy. Clearing site data for this origin has the same effect in your browser; the server-side session then simply expires on its own.
4. No tracking
Beyond the session cookie above, there are no analytics scripts, no tracking pixels, no advertising identifiers, no session recording and no third-party cookies set by us — in the dashboard, on these pages, or on contextator.com.
5. Third-party requests
The dashboard and these pages load typefaces from Google Fonts (fonts.googleapis.com and
fonts.gstatic.com). Those requests are made by your browser to Google, which receives your IP address
and user agent; the Fonts API is not used to set cookies, but the request itself does leave your machine. An operator
who wants a fully self-contained installation can download the two font families and serve them from
public/ instead.
Beyond that, the pages load nothing from anywhere else: no CDN scripts, no embedded players, no social widgets.
6. Changes
This page names every cookie the software sets. If another one is ever added, it appears in the table above before it is set, and the date at the top changes. See the Privacy Policy for what the server stores about your account.