Cookies, itemised
Cookie Policy
Prefer plain words? Read what we keep, and why — the same story without the clause numbers.
Related: Privacy Policy · Terms of Service
This policy explains the small pieces of storage — cookies — that DPDPA Workflow uses on this website, and the choices you have about them. Where any of these can identify you, the data they handle is digital personal data under the DPDP Act, 2023, and this policy is part of how we meet that law.
The short version. Every cookie here is first-party. There are no advertising cookies, no cross-site trackers, and no third-party analytics — and the cookie centre beside the sign-in button can delete all of them in one click.
01Cookies we cannot run the service without
A few cookies are strictly needed to deliver what you asked for: keeping you signed in and keeping the sign-in flow secure. For these we rely on Section 7 (a) of the DPDP Act — you voluntarily requested the service they make possible. We do not ask consent for them, but we still list them so nothing is hidden:
| Cookie | What it does | Data it touches | How long it lasts |
|---|---|---|---|
| Session token (authjs.session-token) | Keeps you signed in as you move between pages; sealed (httpOnly), unreadable by page scripts | A signed token referencing your account | Up to 30 days, or until you sign out or delete it |
| Sign-in security token (authjs.csrf-token) | Protects the sign-in flow against cross-site request forgery | A random token — no personal data | The browser session |
| Return address (authjs.callback-url) | Remembers which page to return you to after sign-in | The page address you signed in from | The browser session |
In production these carry the browser's __Secure- prefix and are sent only over HTTPS.
02The one analytics cookie — opt-in
We count visits with a single first-party cookie, and it is genuinely opt-in: it is set only after you choose "allow" in the cookie notice, and never set at all if you choose "essential only". It contains a random identifier — generated by a coin-flip, not derived from you — so we can tell "someone came back" without knowing who that someone is. It is never shared, never joined with advertising data, and never follows you to another site:
| Cookie | What it does | Data it touches | How long it lasts |
|---|---|---|---|
| Visitor id (dpdpa_vid) | Lets us count visits and see which pages help people. Set only after you allow it in the cookie notice | A random identifier only | 365 days, or until you delete it |
Deleting it costs you nothing — the site works identically without it. You can remove it (and everything else) from the cookie centre at any time.
03Preference cookies and on-device storage
| Cookie | What it does | Data it touches | How long it lasts |
|---|---|---|---|
| Cookie notice choice (dpdpa_cookie_ack) | Remembers your choice in the cookie notice, so it is not shown again | A single yes/no flag | 365 days |
| Terms acceptance (dpdpa_terms_ack) | Remembers that you accepted the Terms of Service and Privacy Policy at sign-in, so the question is asked once | A single yes flag | 365 days |
Two items use the browser's local storage rather than cookies — they never travel to our servers with your requests: the anonymous assessment session id (so you can resume the free applicability check), and — only after you agree, either in the cookie notice or when explicitly asked before your first board deck — the answers you typed into the board-deck form, kept so the form starts filled in on your next visit. Both stay until you clear this site's data.
04What we record on our servers alongside cookies
For completeness — because a cookie policy that hides the server half is only half a policy — these records exist on our side and are described fully in the Privacy Policy:
- Page views. Each page view is stored with the random visitor id and a shortened, one-way-scrambled form of the network address it came from. This is how we count traffic and spot abuse of the free document generators.
- Sign-in history. When you sign in, the time and originating address are recorded so unusual activity is visible — to you. Your history ships inside your data export.
- Rate-limit counters. Short-lived counters that keep the free tools available for everyone by slowing down automated abuse.
05Your controls
- The cookie centre. The cookie icon beside the sign-in button opens it on every page. "Delete all cookies" removes every cookie this site has set — including the sealed ones your browser will not let scripts touch — and signs you out.
- Your browser. Every browser can block or delete cookies for this site; nothing here resists that.
- Your account. Signed-in data — answers, registers, documents, history — can be exported or erased from the account page at any time.
The plain-words companion to this document — what we keep at every step and why — is at /your-data on this site.
06Third parties
There are none in the browser. No advertising networks, no social-media pixels, no third-party analytics scripts, no fonts or scripts loaded from tracking CDNs. Sign-in uses Google OAuth: when you choose to sign in, Google's own pages and policies apply on Google's domain — no Google cookie is set by us on this site.
07Changes to this policy
If we ever add a cookie, this document, the cookie centre inventory and the "Last updated" date above change in the same release — the list you read is generated from the same source the site runs on. A new cookie that needs your permission will ask for it before it is set, per purpose, with no pre-ticked boxes.
08Contact
Questions about cookies can be sent to: DPDPA Workflow · Email: hello@deepdivelabs.tech
This Cookie Policy follows the structure of the cookie-policy template we publish for our customers — the same standard we ask of others, applied to ourselves.