ABOTAN · Policies & reader information
Cookies & Browser Storage
Policy draft — jurisdiction-specific legal review pending. No compliance guarantee.
Administration session
abotan_admin_token is a necessary admin authentication cookie: HttpOnly, Secure in production, SameSite=Lax, Path=/, host-only (no Domain attribute). Its lifetime is at most 12 hours and may end sooner when the signed token expires. Logout clears this browser cookie. It is not available to JavaScript, is not stored in localStorage and is independent of draft or preference choices. There is no reader-account cookie. ABotan uses a random first-party visitor cookie (abotan_visitor). It is HttpOnly, Secure in production, SameSite=Lax and shared across abotan.com and its subdomains, with a lifetime of up to one year. It groups HTTP requests from the same browser; it does not identify a person or physical device. Clearing or blocking site cookies removes or prevents this continuity. An ordinary browser request without a valid cookie receives a new ID immediately. Blocking cookies prevents continuity.
Requested interface preferences
abotan-language and abotan-theme are localStorage preferences written when you choose a language or theme, not automatically on a first visit. They have no application expiry; they remain until cleared by you or your browser. The controls below remove saved preferences; current-page choices remain until the next visit. If storage is blocked, choices still work for the open page but may not persist.
Legacy work drafts
Submit Work no longer saves or restores drafts on this device. Text remains only in the open form until submitted or the page is left. Drafts saved by older versions can be erased with the legacy-draft control below or browser settings.
Request retries and browser caches
abotan-create-* sessionStorage entries contain hashed request identifiers and random retry keys, not raw form contents or authentication tokens. They prevent duplicate saves after uncertain responses and are cleared after confirmed success or when the browser ends that page session, subject to browser session restoration. A hash is not a guarantee of anonymization. Browsers also cache resources under normal HTTP caching rules; no application service worker or IndexedDB store is configured. Browser settings can clear site data.
Optional Google Analytics
Fonts are served by ABotan. Optional maps, external images, links and calendar services may contact their providers. First-party request statistics use the visitor cookie described here; no advertising tracker is added. When configured, Google Analytics 4 (Google) measures public website usage only after you allow analytics. Before permission, after rejection, and in excluded browsers the application does not load the Google tag. It is separate from necessary storage and from MongoDB request/audit logs. No advertising, remarketing, Google Signals or User-ID feature is intentionally enabled. With permission, Google may process browser/device category, sessions, engagement, coarse public page groups, referrer origin, successful submission completion and calendar downloads. ABotan sends no form values, work text, contributor names/emails, private/admin pages, search terms, MongoDB IDs or abotan_visitor IDs to GA4. Public content identifiers are replaced with grouped routes, so analytics is not a per-work readership report. Google receives connection information when a request is made; ABotan does not add IP addresses to event payloads. Analytics is not authentication or identification of an exact physical device.
Analytics preferences and review
Allow or reject analytics with equally accessible controls and change or withdraw your choice at /cookies. abotan-analytics-consent stores the choice and version in localStorage for up to 180 days. Withdrawal disables further collection and attempts to clear this integration’s readable analytics cookies; it cannot recall requests already sent or erase data already held by Google. If storage is blocked the choice applies to the current document only. Language/theme, authentication, submission declarations and technical logs remain separate. LEGAL REVIEW REQUIRED — operator jurisdiction, legal basis, provider terms and international transfers must be reviewed before activation. GA cookies use the _abotan prefix (for example _abotan_ga and _abotan_ga_<stream suffix>) and have a configured maximum lifetime of 180 days without rolling extension; browser restrictions may shorten this. abotan-analytics-excluded is a browser-profile localStorage preference set only through authenticated Admin Settings. It persists after logout until changed or cleared and is independent of analytics permission. Other browsers and private profiles require separate choices. No fingerprint is used. Google property retention is configured in the Google console, not by this code. The deployment recommendation is two months of user/event retention with reset on activity disabled; the live setting has not been verified. Standard aggregated reports may have different retention. Google is a separate provider; processing locations and transfer safeguards depend on its applicable terms and the operator’s circumstances and require legal review. No compliance certification is claimed.
Optional website analytics
Allow Google Analytics to measure public page usage and selected actions? No advertising features. Rejecting keeps the site fully usable. Change this choice here at any time.
Analytics is not enabled for this site environment.
Browser storage controls
Analytics permission is managed separately above. These controls remove saved data on this browser; they do not withdraw submitted work, erase server records or log an administrator out.