1. The current cookie inventory
| Name | Purpose | Duration / controls |
|---|---|---|
| dl_session | Essential first-party authentication cookie. An opaque random token; the server stores its hash. | Seven days by default. HTTP-only, SameSite=Lax, path /. Secure must be enabled on the production HTTPS service. Sign-out removes it. |
| dl_admin_challenge | Essential administrator password-verification challenge, before second-factor verification. | Five minutes. HTTP-only, SameSite=Strict, path /api/admin. Secure must be enabled in production. |
| dl_admin_session | Essential administrator session after password and second-factor verification. | Twenty minutes of inactivity, renewed by user interaction. Locks after ten idle minutes; password re-entry is required. Three failed unlock attempts revoke the session. HTTP-only, SameSite=Strict, path /api/admin. Secure must be enabled in production. |
2. Your choices
The current application does not set advertising or analytics cookies. There is no optional tracking to accept, reject or withdraw, so an “Accept all cookies” banner would not describe the product accurately. You can browse public pages without signing in.
You can remove or block cookies in your browser, but blocking the authentication cookie prevents sign-in from working. Landing-page animations start enabled and can be paused using the always-visible Page animations control. This choice is held only in the current page’s memory and is not saved to cookies or local storage; it does not change your device settings. Other application pages follow the device’s reduced-motion setting.
3. If optional services are added
Any future non-exempt storage or access technology must remain disabled until the required consent is obtained. Where consent is needed, provide an equally accessible refusal option, purpose-specific choices and an easy way to withdraw. Assess the rules in each launch country; UK exemptions should not be assumed to apply throughout the EU.
Map tile requests are described in the privacy notice. A network request is not automatically a cookie, and a cookie choice does not replace the assessment of personal information disclosed to the map provider.
4. Production verification
This inventory describes the application source. CDN, security, analytics and other hosting services have not been selected. Inspect actual production browser storage and network behaviour before publishing a final inventory. Developer-tool cookies, if present in a local development environment, are not part of the production service design.
Official guidance & references
The sources below inform the review. They do not certify this product or replace the company’s operational responsibilities.
ICO: storage and access technologiesEU General Data Protection Regulation