Cookie policy

This policy covers HTTP cookies and browser local storage used for technical or internal measurement purposes.

• HttpOnly session cookies (`tracea_access_token`, `tracea_refresh_token`) — required to maintain signed-in sessions without JavaScript access. Duration: until logout or revocation.
• Parent portal offline queue and operational cache — required for sync and performance. Duration: variable; removable by signing out and clearing site data.
• App Lock — encrypted PIN in device localStorage; not transmitted to TRACEA servers.

TRACEA records interface metrics in localStorage under `tracea_ui_metrics` (screen opens, load times, UI errors, completed flows). Up to 200 recent events.

This data remains on the user's device; it is not commercial profiling in current code.

Current status: Google Analytics is not integrated in code deployed as of this version.

Planned / pending integration: if activated in the future, this policy will be updated with identifiers, purpose, duration, and legal basis before production use.

You may delete localStorage and site cookies from your browser settings. This will sign you out and may affect offline functionality.

PENDING DEFINITIVE POLICY: granular consent banner if third-party analytics cookies are added.