Cookie Policy
Cookie Policy
Default template – please complete master data and publish your own version if needed.
Cookie Policy of {{companyName}}
Controller: {{companyName}}, {{addressBlock}}
Contact: {{email}} · Privacy: {{dpoEmail}}
This Cookie Policy explains which cookies and similar technologies (LocalStorage, SessionStorage) we use. It complements our Privacy Policy. Legal bases: Art. 6(1) GDPR and § 25 TDDDG (Germany).
1. What are cookies?
Cookies are small text files stored on your device. Similar technologies (e.g. LocalStorage) also store information in the browser. We distinguish strictly necessary and optional cookies.
2. Consent and withdrawal
Strictly necessary cookies are set without consent (§ 25(2) TDDDG). Optional categories (functional, analytics, marketing) only after your consent via our cookie dialog. You may withdraw or change your choice at any time via “Cookie settings” or privacy settings (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing before withdrawal.
3. Strictly necessary cookies / storage
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| better-auth.session_token | Authentication session (24 hours from login) | 24 hours | {{companyName}} |
| better-auth.two_factor | Temporary 2FA status | Session | {{companyName}} |
| better-auth.trust_device | Trusted device (fewer 2FA prompts) | 30 days | {{companyName}} |
| mto_login_method | Draft: remembers the login method (password / passkey / email OTP) for account security (httpOnly, server-signed); decides whether extra TOTP is needed; no tracking | 24 hours | {{companyName}} |
| NEXT_LOCALE | Language preference | 1 year | {{companyName}} |
| mto_locale_region_prompt | Stores accept/decline of the regional language hint (draft) | 1 year | {{companyName}} |
| mto_consent_id | Anonymous consent ID (proof) | 1 year | {{companyName}} |
| rd-office-theme (LocalStorage) | Light/Dark/System without flash | persistent | {{companyName}} |
| rd-office-last-activity (LocalStorage) | Draft: idle-timeout logout is not the default (no 15-minute logout); leftover entry without automatic sign-out if present | until logout | {{companyName}} |
| ai-act-disclosure-accepted (LocalStorage) | Remembers acknowledgement of the AI notice (EU AI Act Art. 50); independent of cookie consent | persistent | {{companyName}} |
| Cookie decision cookie | Stores your cookie choice | 30 days | {{companyName}} |
| OAuth state (Better Auth) | CSRF protection: Apple/Google (login or self-link); Microsoft Entra company SSO (admin-enabled only, no self-link) | short-lived | {{companyName}} |
Legal basis: Art. 6(1)(b)/(f) GDPR and § 25(2) TDDDG.
Native app: The Expo app does not use browser cookies. Session tokens are stored in SecureStore; local demo inbox data in AsyncStorage (technically necessary, no tracking).
4. Optional categories
- Functional: optional UI/comfort settings (consent only).
- Analytics: currently inactive placeholder – only if activated later and with consent.
- Marketing: currently inactive placeholder – only if activated later and with consent.
Optional scripts are not loaded without consent.
5. Third parties, domains & infrastructure
Application browser cookies are first-party (table above). We currently load no third-party analytics or marketing cookies.
Infrastructure (no in-app cookie tracking, but processing):
| Provider | Role | Cookies in the app? | Processing |
|---|---|---|---|
| STRATO GmbH (DE) | Domain registrar | No | Registrant master data for registration/registry (DPA on file) |
| Cloudflare, Inc. | DNS (typically DNS-only) | No (DNS-only) | DNS queries for name resolution; if proxy is enabled later, additional HTTP metadata (DPA on file) |
| Vercel Inc. | App hosting | No (first-party app cookies are listed above) | Delivery / server logs |
If optional services (e.g. analytics) are activated later, we will name provider, purpose, retention and any third-country transfer here and obtain consent first. More detail: Privacy Policy.
6. Browser settings
You may delete or block cookies in your browser. Blocking strictly necessary cookies may limit or prevent use of the application.
7. Updates
For material changes we update this policy and may re-prompt for consent.
8. Contact
{{dpoName}}, {{dpoEmail}} or {{email}}.