Cookie Policy
Last updated: [DATE]
This policy explains the cookies and similar technologies that [COMPANY LEGAL NAME] ("Ehkam", "we", "us") uses on ehkam.net, on our customers' Workspace addresses, and in the Ehkam web app. It should be read with our Privacy Policy and our Terms of Service.
1. What cookies and browser storage are
- A cookie is a small text file that a website asks your browser to keep and send back on later visits.
- Browser storage (local storage, session storage and IndexedDB) lets a web app keep small pieces of data in your browser. Local storage stays until it is cleared. Session storage is cleared when you close the tab.
In this policy, "cookies" covers both unless we say otherwise.
2. Our approach
- We use cookies only to make the service work, to keep it secure, and to remember choices you make.
- We do not use advertising cookies, advertising pixels, or cookies that track you across other websites.
- Our website analytics set no cookies (section 5).
- We do not sell or share what these cookies hold with advertisers.
3. Strictly necessary cookies
The service cannot work without these. They keep you signed in, protect your account and forms, and send you to the right organisation. Because they are necessary, they cannot be switched off in the service; blocking them in your browser will stop you signing in.
| Name | Purpose | Kept for |
|---|---|---|
access_token | proves you are signed in on each request. Cannot be read by page scripts. | 15 minutes by default; your organisation may set between 1 and 60 minutes |
refresh_token | renews your sign-in when access_token expires. Cannot be read by page scripts, and is sent only to the sign-in service. | 30 days by default; your organisation may set between 1 and 365 days |
has_session | tells the web app that you are signed in, without revealing anything about the sign-in itself | as long as refresh_token (30 days by default) |
csrf_token | protects forms and changes you make against cross-site request forgery | up to 30 days, renewed with your sign-in |
trust_token | remembers a device you chose to trust, so you are not asked for a two-factor code on it every time. Cannot be read by page scripts. | 30 days by default; your organisation may choose 7, 14, 30, 60 or 90 days |
ehkam-subdomain | remembers which organisation's address you are using | until you close your browser |
ehkam-subdomain-verified | remembers that the organisation's address was checked, so it is not checked on every page. Cannot be read by page scripts. | 6 hours |
4. Preference cookies
These remember choices you make. They hold no information about you beyond the choice.
| Name | Purpose | Kept for |
|---|---|---|
locale | your language (Arabic or English) | 1 year |
sidebar_state | whether the app's side menu is open or closed | 7 days |
5. Analytics and monitoring
- Website analytics: on our public website we may use Plausible, which counts page views, referring sites, browser type and approximate country without setting any cookie and without storing your full IP address.
- Visit records: our servers may record a visit to the app (masked IP address, browser and referring page) to understand how the service is used. This is done on our servers and sets no cookie.
- Error monitoring: in the production web app, our error-monitoring provider, Sentry, may keep a session identifier in your browser's session storage, so that if an error happens it can link a short replay of the screen to the error report. It is cleared when you close the tab. [PLACEHOLDER: engineering to confirm the exact storage key Sentry's replay component uses]
6. Browser storage the web app uses
The web app keeps the following in your browser. None of it is used for advertising, and none of it is shared with third parties. Sign-in tokens are kept in the cookies in section 3, not in browser storage.
Needed for the app to work:
| Key | Purpose | Kept for |
|---|---|---|
user | your profile (such as your name, email, language and time zone) and the list of organisations you belong to, so the app can show them before it has loaded. Your roles and permissions are not stored. | until you sign out |
current_account_id, current_tenant_id, current_account_meta | which of your organisations you are working in | until you sign out or switch organisation |
auth:last_refresh_ms | when your sign-in was last renewed, so open tabs do not renew it at the same time | until you sign out |
scope_version: (one per organisation) | detects when your roles or permissions change, so the app can refresh them | until you sign out |
_2fa_pending_login | a flag that finishes a sign-in after warning you that few backup codes remain | until you sign out |
device_id | a random identifier for this browser, used to list your signed-in devices and to recognise a device you trusted | until you clear your browser's storage |
2fa_setup_token, 2fa_setup_required, 2fa_grace_days (session storage) | carries you through setting up two-factor authentication when your organisation requires it | until you close the tab |
Preferences:
| Key | Purpose | Kept for |
|---|---|---|
locale | your language, for the app's requests | until you clear your browser's storage |
theme | light, dark or system appearance | until you clear your browser's storage |
fill_mode_preference: (one per organisation) | how you like to fill in checklists (step by step, all at once, or one item) | until you clear your browser's storage |
nav_dashboards: (one per organisation and person) | a copy of your dashboard list, so the menu shows it straight away | until you clear your browser's storage |
ehkam.push_prompt | when you dismissed the offer to turn on notifications, so we do not ask too often | until you clear your browser's storage |
system-announcement-snoozed: (one per announcement) | that you snoozed a service announcement | until you clear your browser's storage |
2fa_grace_banner_dismissed (session storage) | that you closed the two-factor reminder banner | until you close the tab |
Notifications: if you allow browser notifications, Google Firebase stores a notification token in your browser's IndexedDB so that we can deliver notifications to it. It stays until you withdraw the browser's notification permission or clear your browser's storage.
7. Third parties
- Maps: when a page shows a map, your browser loads map images, and may look up the address of a point you pick, directly from OpenStreetMap's servers. Those servers receive your IP address and the map area or coordinates requested. We do not ask them to set cookies; their own policies apply.
- Payments: when you pay for a subscription, Stripe may set its own cookies on its payment pages, mainly to prevent fraud. Stripe's cookie policy applies to them.
- Single sign-on: if you sign in with Google, Apple or your organisation's single sign-on, that provider's own pages and cookies apply while you are there.
8. The mobile app
The Ehkam mobile app does not use browser cookies. It keeps your sign-in in your device's secure storage, and your preferences in the app's own storage on your device. Removing the app deletes them.
9. How to control cookies
- Most browsers let you see, block and delete cookies and site data in their settings. Each browser's help pages explain how.
- If you block or delete the strictly necessary cookies, you will be signed out and will not be able to sign in until you allow them again.
- Deleting preference cookies or browser storage resets your choices, such as your language and appearance.
- Signing out removes your sign-in cookies and the sign-in data in section 6.
10. Changes to this policy
If we start using a new cookie or a new kind of browser storage, we will update this policy and the date above before we do. We will not start using advertising or cross-site tracking cookies without first updating this policy and asking for your consent where the law requires it.
11. Language
This policy is offered in Arabic and English. If they differ, the [Arabic] version prevails [PLACEHOLDER: counsel to confirm, as in the Terms].
12. Contact
Questions about this policy: [privacy@ehkam.net]. [COMPANY LEGAL NAME], [ADDRESS], Kingdom of Saudi Arabia.