Cookies & in-browser storage

Summary

Marvin sets one strictly-necessary cookie for login and a small amount of in-browser storage to remember your sidebar layout and any draft cases you start. No analytics, no advertising, no third-party trackers.

What we set

Strictly necessary

• Authentication session — a signed, HttpOnly cookie issued by the Marvin server when you sign in at /admin/login. It keeps you logged in for the duration of your session and is cleared when you sign out. Exempt from PECR consent because it's required for a service you've explicitly requested.

Functional (non-essential)

• Sidebar layout cookie — a first-party cookie set by the operator console to remember whether the sidebar is collapsed. Lifetime: 7 days. No personal data; just a boolean.
• Draft cases (localStorage) — when you start a case at /decision/new, a snapshot is saved in your browser so you can return to it later. Stays in your browser until you clear it or delete the case. Never sent to a server unless you choose to run it.
• Demo-autofill memo (localStorage) — a tiny flag remembering which preset case you last opened, so the inbox highlights it on return. No personal data.

What we don't set

• No analytics cookies (no Google Analytics, no Plausible, no PostHog).
• No advertising or marketing cookies.
• No third-party trackers, fingerprinting, or session-replay scripts.
• No social-media embed cookies (no embedded YouTube, X, Facebook, LinkedIn).

Your choices

The banner that appears the first time you visit gives you two equal-weight options:

• Accept all — keeps the sidebar layout cookie and draft-case storage working as designed.
• Reject non-essential — disables the functional items above. Strictly-necessary login still works. Closing the banner without choosing is treated as reject.

You can revisit or change your decision at any time:

Caveat — current honest state

As of this version, your choice is recorded but not yet enforced at write time on the two functional items above — retrofitting those write sites to consult the consent flag is on the engineering backlog. The strictly-necessary auth cookie is unaffected. We surface this caveat here rather than quietly ignore it; remove this paragraph when the retrofit ships.

How to clear cookies in your browser

All major browsers let you delete cookies and clear site storage per-domain (Settings → Privacy → Site data, or equivalent). On this domain, doing so will sign you out of /admin and drop any saved draft cases.

Contact

Questions about cookies or storage: hello@marvinos.uk.