Cookies and local storage

Version 2026-10-28.a9f10b97 · draft of 2026-10-28 · not yet in force

Details supplied by the owner

Legal entity: Not set yet (owner input pending)
Address: Not set yet (owner input pending)
Contact: Not set yet (owner input pending)
Governing law: Not set yet (owner input pending)
Data region: Not set yet (owner input pending)
Effective date: Not set yet (owner input pending)

A. Exact inventory

A1. The loader on a customer's website (`packages/loader`)

The loader sets no cookies and reads none. Its requests use credentials: 'omit'. It stores data in the visitor's browser under the key prefix rl:<siteKey>: using localStorage, falling back to IndexedDB (database rl, object store k) when localStorage is blocked or full.

Key (prefix `rl:<siteKey>:`)	Stored value	Purpose	Written when	Source
`lang`	the language code the visitor chose (for example `fr`)	remember the visitor's choice	only when the visitor (or the site's code) calls `setLanguage`, i.e. after an explicit choice. `localStorage` only: the IndexedDB fallback does not receive it, so with `localStorage` blocked the preference is not kept. On sites with language URL prefixes (WordPress, Shopify) the URL decides and the stored value has no effect (finding G-S3)	`loader.ts:323`
`m`	the last accepted signed manifest (JSON: languages, file names, hashes, signature, key id)	show the translation immediately next visit and survive an outage	on first load, before any choice, whenever a valid manifest is fetched	`loader.ts:306`
`v`	the highest manifest version accepted (a number)	refuse rollback to older manifests (security)	on first load, whenever a newer version is accepted	`loader.ts:288`
`f:<languageCode>`	`{ file name, translation strings for that language }`	avoid downloading the language file again; works offline	when a language is first activated, including one derived from the page URL prefix or a previously stored choice	`loader.ts:143-156`

No expiry is set by the loader; the data stays until the visitor clears site data or a newer version replaces it. OPEN: should it expire?
None of this is sent to us. It contains no personal data about the visitor except the language preference, which is a preference, not an identifier.
There is no switch to turn the cache off (data-storage="none" is a proposal in PRIVACY.md and finding F-26; D21 does not allow new attributes). This is gap G3.
The loader reads the browser language locally (navigator.languages) to offer a suggestion; it never redirects by IP or Accept-Language, and sends no request for this.
All storage calls are guarded. Blocking localStorage alone does not stop local caching: manifest, version and language files move to IndexedDB rl/k (finding G-S2).
Measured in Chromium (5 tests, 2026-10-29): no cookie is set or sent, requests are plain GETs of static files with no query or body, two visitors hold byte-identical storage (no identifier), and a cross-origin CDN sees only the customer's origin in Referer/Origin. Firefox and Safari are untested (verify). rl:<siteKey>:v holds {r, v} (key rank and highest version).

A2. The language switcher (`packages/switcher`)

sessionStorage key rl-sw-dismiss: remembers for the current tab session that the visitor dismissed the "suggest a language" banner. Cleared when the tab closes. No cookies.

A3. Visitors' network requests (not storage, listed for the customer's own notice)

Bundle files are fetched from the customer's own site first, then from CDN hosts. Those hosts see IP address, user agent, Accept-Language and the customer's origin in Origin/Referer (measured; never path or query).

A4. Our dashboard, account pages and API (users with accounts)

| Name | Type | Set by | Properties | Lifetime | Purpose | Source | |---|---|---|---|---|---|---| | __Host-rl_session | cookie, first party | Identity module | Secure, HttpOnly, SameSite=Lax, no Domain (the __Host- rules) | server-side session: 30 min idle / 8 h absolute (operators 15 min / 4 h); cookie is a session cookie unless persistence is configured: verify | keep the user signed in | src/ResilientLang.Identity/IdentityOptions.cs:60, | | __Host-rl_csrf | cookie | Identity module | Secure, anti-forgery | session | prevent cross-site form posts | IdentityServiceCollectionExtensions.cs:92 | | __Host-rl-backoffice | cookie | Back-office | operator console only; HttpOnly, Secure, SameSite=Strict, non-persistent | 2 h absolute; ticket holds user id, name, e-mail, role | sign operators in | src/ResilientLang.Backoffice/Services/ServiceCollectionExtensions.cs:71 | | ~~Dashboard's own cookie (8 h)~~ | none found | Earlier notes mention one; a code search by WP-61 found no cookie set by the Dashboard modules (sign-in is Identity's). Keep verify until seen in a running deployment | | | | | | Framework TempData cookie | cookie | ASP.NET on billing pages | framework default: verify | session | one-time notices; may carry Stripe error text (up to 200 chars) | same | | ASP.NET anti-forgery cookie on the public sign-up/log-in forms and (WP-111) the waiting-list form on /platforms/wordpress and /platforms/shopify | cookie | marketing/product site | default ASP.NET name and properties: verify | session | form security | src/ResilientLang.Marketing/Seo/DefaultContent.cs | No advertising, analytics or cross-site cookies exist anywhere in the code. The marketing pages and guides set no cookies and load no third-party resources. The dashboard scripts for account pages do not use browser storage (a page test asserts "scripts free of storage").

A5. The WordPress plugin on a customer's site

No cookies. It stores settings in WordPress options and downloaded bundles in wp-content/uploads/resilientlang/. The consent checkbox gates only the server-side sync. The front-end loader is enqueued whenever site key and public key are set and its data-base includes the CDN addresses, so visitors' browsers can request the CDN with the box unticked (disclosed in readme.txt but not tied to the box).
api_key is stored in plain text in wp_options; uninstall removes options and keeps the files unless "delete" is ticked, and does not remove resilientlang_seo.
The licensed build contacts our licence server with the licence key, site domain and plugin version, has no consent gate and no uninstall hook; update download URLs carry licence id and domain in the query string.

A6. Shopify theme extension

Same loader as A1. Whether Shopify permits external scripts in theme extensions is unverified.

B. Draft notice text (for counsel to rewrite)

For visitors of customer sites (the customer decides where to publish):

"This site uses a translation script. When you open the page it may save a small file in your browser's storage (not a cookie) so translated text appears quickly and keeps working if the translation service is unavailable. If you choose a language, we remember your choice in the same way. This information stays in your browser and is not sent to us or used for advertising or tracking. You can remove it by clearing this site's data in your browser settings. The translation files are loaded from this site and from content-delivery servers, which receive your IP address and browser type when they deliver the files."

For our own dashboard: "We use essential cookies to keep you signed in and to protect forms. We do not use advertising or analytics cookies."