Cookie policy

The session cookie

sg_session holds your signed-in session. It is set when you sign in and removed when you sign out, and it lasts 24 hours at most. It is HttpOnly, so no script on a page can read it, SameSite=Strict, so another site's page cannot send it, and Secure wherever the platform is served over https.

It is strictly necessary: without it no one can sign in. It is set by SafeMode alone and never shared.

What is kept in your browser's storage

safemode_theme, the light or dark theme you chose, on this site too; safemode_user, your name and role, to draw the page before the server answers; safemode_selected_org, the organisation you last opened; safemode_sidebar_collapsed and safemode_sidebar_folded_sections, how you left the side menu; and safemode_export_history, the exports you made from that browser.

In the tab's session storage, safemode_session_ended marks a session that ended, so the sign-in page can say why, and safemode_assessment holds the self-assessment's answers until the tab closes, so a refresh resumes it. None of these leaves your device.

Checks

Pages load no third-party subresources. The typefaces are served by SafeMode rather than a font CDN, and the pages include no external scripts or remote images.

This can also be verified in the browser's Application and Network panels.

What the host can see

Serving a page gives the host the reader's IP address and request metadata. This is processing on a server, not storage on the reader's device, so the ePrivacy consent rule does not apply to it. The privacy policy describes this processing.

Your choices

Your browser's settings can block or delete cookies and site storage. Blocking sg_session prevents signing in; clearing local storage resets the theme and the menu.

Changes

Any future device storage, including remembered preferences, will be disclosed here before deployment. A cookie that is not strictly necessary would be set only after you agree to it.