Use of cookies
CheckTau uses first-party cookies to remember choices and protect staff access. This page distinguishes them from mobile app storage and features that may be enabled in the infrastructure.
What they are and where they are used
A cookie is a small piece of data a website stores in your browser, which returns it with later requests. The public website and staff area use different hosts: their first-party cookies are not shared through a common domain. Native apps do not use this Web cookie to sign in.
First-party cookies
| Cookie | Purpose and duration |
|---|---|
checktau_web_theme | Remember the light or dark theme you select. Where: Public website and staff area, separately on each host. Provider: CheckTau (first-party cookie) Duration: One year from your most recent selection. |
checktau_web_lang | Remember your chosen language: Spanish, French or English. Where: Public website and staff area, separately on each host. Provider: CheckTau (first-party cookie) Duration: One year from your most recent selection. |
__Host-checktau_session | Protect the sign-in form and maintain the session with an opaque identifier. It contains no passwords, API tokens or records. In production, it is HttpOnly, Secure and SameSite=Lax. Where: Staff area; not needed to obtain the public pass. Provider: CheckTau (first-party cookie) Duration: Before sign-in, up to 30 minutes. An authenticated session lasts at most 89 days, 23 hours, and 55 minutes and ends after 29 days, 23 hours, and 55 minutes of inactivity, or earlier through server/API expiry or revocation. Renewal does not extend that absolute maximum. |
Preferences are saved when you choose a language or theme. They have path / and SameSite=Lax; they do not contain your name, PIN, profile or QR. The session is created when you open staff sign-in and is managed on that host. The durations reflect Web settings; the API or organisation may end access earlier.
Purpose and consent
Access and security cookies provide the requested service; theme and language cookies remember an express choice. For those purposes, without reuse for others, the prior-consent exceptions described by the AEPD apply. Our own code does not install advertising or behavioural measurement cookies.
Other browser and device data
The public pass, PIN, QR and Wallet links are not intentionally saved in localStorage, sessionStorage or a browser database. The pass stays in memory and downloaded files remain on the device. The browser may keep addresses, filters and navigation in its history. Deleting cookies does not erase history, files or organisational records. Native credentials and preferences are explained in Privacy; Android ML Kit diagnostics are not a Web cookie.
Change, block or delete
Change language and theme in the header. Delete or block cookies through browser privacy settings, checking the public and staff hosts separately. Without preference cookies, choices will not be remembered; without a session cookie, staff access will not work. The public website and its documents remain available. On a shared computer, sign out and review history and downloads. Deleting the cookie is not equivalent to closing all server sessions.
Infrastructure cookies
Cloudflare may use security or traffic-management cookies depending on the enabled features. Examples include:
__cf_bm: Bot protection; the provider states 30 minutes of inactivity.cf_clearance: Retain the result of a security challenge; duration depends on configuration.
You can consult documentation about cookies and their purposes on Cloudflare’s official website.
Cloudflare may process data outside the European Economic Area. Privacy explains the providers and how to request information about applicable safeguards. CheckTau privacy policy
Further information
The AEPD cookie guide and guidance are available on its official website.
The date identifies this version. It will be reviewed if cookies, purposes or services change.