01The short version
We set two first-party cookies, both strictly necessary to sign you in and keep you signed in. We run no analytics, no advertising, no session recording and no third-party scripts on our public pages. Nothing here tracks you across sites or builds a profile of you. There is nothing to opt out of, which is why we do not ask you to.
Most cookie banners exist because most sites have something to declare. We don't.
A cookie is a small piece of text a site asks your browser to keep and send back on later requests. It is how a website remembers that the person loading this page is the same person who signed in a minute ago. Ours do that and nothing else.
02Every cookie we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
hfs2s_session |
Keeps you signed in. Holds your email address and an expiry, sealed with a cryptographic signature so it cannot be altered or forged. Marked HttpOnly, so no script on the page can read it, Secure, so it only travels over HTTPS, and SameSite=Lax, so another site cannot make your browser send it. |
First-party, strictly necessary | 30 days, or until you sign out |
hfs2s_oauth_state |
Set only if you choose to sign in with Google, and only for the moment that takes. Carries a one-time value that proves the reply coming back from Google belongs to the sign-in you started, which is what prevents a cross-site request forgery attack on the sign-in itself. Deleted the instant the sign-in completes. | First-party, strictly necessary | 10 minutes |
Signed, unreadable by scripts, and never sent to anyone else's server.
Both are set by hfs2s.app itself. Neither is a third-party cookie,
neither is readable by any other site, and neither is sent anywhere except back to
us. The session cookie is scoped to hfs2s.app and its subdomains so
that one sign-in works across the product.
Sign-in links sent by email carry a token in the URL that is valid for 15 minutes and can be used once. That is not a cookie, but it is part of the same mechanism, so it is worth stating here.
03Why there is no consent banner
Article 5(3) of the ePrivacy Directive — transposed into Spanish law by Article 22.2 of the LSSI-CE (Ley 34/2002) — requires consent before storing anything on your device, except where the storage is strictly necessary to provide a service you have expressly asked for. A cookie that signs you in is the textbook example of that exception. Both of ours fall inside it.
A banner that asks permission for a cookie it sets anyway is theatre. We'd rather just tell you.
So the law requires us to inform you, not to ask you. We do that on this page and in a one-line notice the first time you visit. That notice has a "Got it" button and no "Reject" button, because there is nothing here to reject — offering a choice that changes nothing would be a dark pattern, not compliance.
If that ever changes, this page changes with it. The day we add a cookie that is not strictly necessary is the day we add a real consent mechanism, with refusing made exactly as easy as accepting, and with nothing set before you have chosen.
04Other browser storage
Cookie rules apply to any storage on your device, not just cookies, so here is the
rest of it. We use your browser's localStorage for a few small
conveniences. None of it is ever sent to our server, and none of it identifies you.
| Key | What it holds |
|---|---|
hfs2s.cookie-notice.seen | That you dismissed the cookie notice, so it does not reappear on every page |
hfs2s:lastWorkspace | Which workspace you were last looking at, so you land back in it |
| Message queue keys | A message you typed but that has not been sent yet, so closing the tab does not lose it |
Note the first row: we remembered you'd read the cookie notice without setting a cookie to do it.
The first one deserves a comment. The obvious way to remember that someone dismissed
a cookie notice is to set a cookie. We deliberately did not: that would be the only
non-essential cookie on the entire site, set by the very banner whose job is to tell
you there are none. localStorage stays in your browser and is never
transmitted, so it was the honest place to put it.
Clearing your browser's site data removes all of it. Nothing breaks; you will just see the notice again.
05Cookies in apps built here
An app built on hfs2s and served at hfs2s.app/app/<id>/ is its
own application. It may set its own cookies, and if it does, those
belong to the person who built it — not to us. If you are building on hfs2s and your
app sets non-essential cookies, obtaining consent for them is your responsibility.
Our session cookie never crosses into a customer's app, in either direction.
The two are kept strictly apart at the boundary. Our session cookie is stripped from every request before it enters a customer's app — visitors to a shared app are often signed-in hfs2s users who do not own it, and the session cookie is a bearer credential we will not hand to somebody else's code. In the other direction, an app is blocked from setting a cookie in our namespace on the way back out.
Apps are served from hfs2s.app/app/<id>/ rather than from a
domain of their own. A cookie an app sets under its own name is passed
through untouched — and because it is set on this domain, your browser will
hold it for hfs2s.app generally. So after visiting an app built
here, you may be carrying a cookie we did not set, and your browser may send it
back to us and to other apps on the same domain.
We do not read those cookies and they play no part in anything described above. But "hfs2s sets two cookies" is a statement about what we set, and this is the honest footnote to it. If you are building here, do not put anything sensitive in a cookie your app sets.
06Turning them off
Every browser lets you block or delete cookies, in Settings under Privacy — and most offer a per-site control, so you can block ours specifically without changing anything else.
You will not be able to sign in. Both of our cookies exist to carry the sign-in, so blocking them means the site cannot tell one page load from the next. The public pages — this one, the landing page — work perfectly well without them.
There is no tracking to opt out of, so browser "Do Not Track" and Global Privacy Control signals make no difference to what we do. We have nothing to stop doing.
07Changes
If our cookie inventory changes, this page is updated and the notice is shown again to everyone, so a new cookie is never something you find out about by accident.
See also the privacy policy for what we collect beyond cookies, and the compliance page for the legal framework behind all of this. Questions: [email protected].