Cookie Policy
Draft for review. This text has not been reviewed by a lawyer. Highlighted items are placeholders to fill in. Confirm which laws apply (for example Kurdistan Region / Iraq law, and any data-protection rules in contracts with partners or donors) before relying on it.
The dashboard uses only what it needs to work and to stay secure. There are no analytics, advertising or tracking cookies, and no third-party scripts or fonts are loaded, so there is nothing to opt in to. If optional tracking is ever added, it will stay off until you choose to allow it, with equal Accept and Reject buttons.
Cookies
| Name | Purpose | Type | How long |
|---|---|---|---|
smdash_session | Keeps you signed in. Holds only a random identifier; the session data stays on the server. | Strictly necessary, first-party, HttpOnly, Secure, SameSite=Lax | Until you close the browser or sign out; ends after 30 minutes idle and 12 hours at most |
csrftoken | Protects forms and changes against cross-site request forgery. | Strictly necessary, first-party, HttpOnly, Secure, SameSite=Lax | One year (renewed on sign-in) |
Failed sign-in protection is kept on the server and sets no cookie.
Browser storage (not cookies)
| Key | Purpose | How long |
|---|---|---|
smdash.notice | Remembers that you closed the cookie notice. | Until you clear site data |
smdash.pref.* | Display choices only: the last tab, chosen columns, filters and chart view. | Until you clear site data |
No passwords, tokens, or work data are kept in browser storage. Clearing your browser's site data removes all of it; you will need to sign in again.
Questions: [PRIVACY CONTACT]