Legal · version 1.0 · effective 20 July 2026
Cookies and Browser Storage Policy
Disciplio uses only essential authentication storage and user-requested functional browser storage at launch. It has no advertising, analytics, session-replay, or marketing storage.
refresh-cookie
disciplio_refresh is a first-party, essential HttpOnly cookie. It stores a refresh-session token, is created on registration, login, or refresh, is unavailable to JavaScript, uses SameSite=Lax and Secure on HTTPS, has path /api/auth, and lasts up to 90 days. It is removed on logout and expires, is revoked, or is removed with account deletion. The cookie has no Domain attribute, so it is host-only for the API host.
local-storage
The app may use localStorage keys: disciplio-browser-storage-consent-v1 (essential record of your storage choice); disciplio-api-workspace-v1 (optional local workspace cache); disciplio-language-v1 (optional interface language); disciplio-welcome-draft-v1 (optional unfinished registration draft, seven days, never a password or legal-checkbox choice); disciplio-onboarding-guide-position-v1 and disciplio-onboarding-guide-collapsed-v1 (optional onboarding display preferences). These are first-party, JavaScript-accessible functional storage on app.disciplio.me, created when the relevant feature is used and removed when optional storage is rejected, cleared in the browser, or, for the draft, expires.
session-storage
The app may use sessionStorage keys: disciplio-goal-creation-drafts-v1 for temporary signed-in goal drafts (first-party, functional, JavaScript-accessible, deleted when the browser session ends, the draft is cleared, or optional storage is rejected) and disciplio-stale-chunk-reload-v1 for a one-time reload-recovery marker (essential technical storage, deleted after successful recovery or when the session ends).
control
You can accept or reject optional browser storage in the app. Rejecting removes optional keys immediately. Browser settings can also clear storage, which may remove preferences or sign you out. The public landing page does not intentionally set non-essential cookies or browser storage.
not-used
Disciplio does not use IndexedDB, service workers, Workbox, Cache API application cache, analytics cookies, advertising cookies, or marketing cookies. This release does not include Turnstile, CAPTCHA, or a Cloudflare challenge-cookie implementation in application code.
changes
If we introduce non-essential storage, we will update this policy and obtain any required consent before it is used.
contact
Questions about storage: privacy@disciplio.me. Effective date: 20 July 2026. Document version: 1.0. Reference language: English.