Cookie and local storage notice (draft)

1. Cookies

One cookie is involved, and 4keys does not set it. Cloudflare Access sets a session cookie when you sign in, and it is what keeps you signed in on the Studio and on the authenticated parts of the interface. It is strictly necessary: without it there is no way to know whose projects to load.

The application code sets no cookie of its own. There is no advertising cookie, no analytics cookie, and no cookie shared with any other site.

2. Local storage

The Studio keeps a copy of your work in your browser's local storage, so an interrupted session is not lost and the editor can open instantly. Every key it writes starts with 4keys:

• A cached copy of each project you have open, keyed by project.
• The identifier of the project you last had open, so the Studio reopens it.
• A copy written by an earlier version of the Studio, which is migrated and then removed.
• A short list of the directions that have already finished and already been announced to you, so the same finished job is not reported twice. It holds job identifiers only, never the direction or its result.

3. Session storage

While a direction is running, the browser keeps a handle to it in session storage so that reloading the tab does not lose track of the result. Session storage is cleared by the browser when the tab is closed.

• The identifier of the direction job currently running for a project.
• The identifiers of authoring proposals in flight for a project. The direction text held alongside one of these is removed 15 minutes after it was written.

4. The public story viewer

Reading a published story sets nothing. The viewer requests the story without sending credentials, writes no cookie, and writes nothing to local or session storage. A reader who has never signed in leaves no state in their browser.

5. What is not here

There is no analytics service, no advertising network, no third-party tag, no tracking pixel, no session recording, and no cross-site identifier anywhere in 4keys. Nothing in your browser is shared with another company for measurement or marketing.

6. Clearing what is stored

Clearing site data for this site in your browser removes the local and session storage described above. Doing so while a project has unsaved local changes discards those changes.

Removing the Cloudflare Access session cookie signs you out; the Studio will ask you to sign in again.

[REVIEWER: confirm whether consent is required for the strictly necessary cookie and for the local storage above under the applicable regime, and whether a consent interface is needed.]