Cookies and local storage

Version 7.1 · Last updated 20 October 2026

1. What we use cookies for

Relocat sets cookies only for session sign-in on the staff surfaces: the admin, moderator, partner and knowledge-graph editor panels. Nothing else on relocat.org, in the app, or on the guest page sets a cookie.

2. Strictly necessary cookies

Signing in to a staff panel sets two cookies: the session cookie (sessionid) and the CSRF cookie (csrftoken). Both are scoped to this site and marked Secure. The session cookie is additionally HttpOnly.

Signing out clears the session cookie. The CSRF cookie is not cleared on sign-out; Django rotates it the next time you sign in instead.

These cookies are strictly necessary within the meaning of § 25(2) TDDDG and Article 5(3) of the ePrivacy Directive. No consent banner is shown, because none is required, and we set no other cookie.

3. Theme preference (relocat.org only)

The public pages at relocat.org remember your light or dark theme choice in one localStorage entry named relocat-theme. This is a strictly necessary preference value: no consent banner is required, no third party reads it, and it is never sent to our server. Clear your browser’s local storage for relocat.org to reset it.

4. Rights Map answers (/map/)

The Rights Map at /map/ asks you a few questions about your situation, such as your nationality and whether you hold or are seeking protection, so that it can show which rules apply to you. It keeps your answers in one localStorage entry named relocat.factset.v1, so that they are still there when you come back. Your answers never leave your browser: they are not sent to our server, and no third party reads them. The map sets no cookie and uses no other browser storage. On each visit it briefly writes and at once removes a second entry, relocat.factset.v1.probe, only to check that storage works; nothing is kept under it.

“Forget my answers” on the map deletes the entry. Clearing your browser’s site data for relocat.org deletes it too. Keeping your answers is necessary to deliver the function you asked for, so it does not require consent (§ 25(2) Nr. 2 TDDDG).

5. Staff panel local storage

The admin, moderator, partner and knowledge-graph editor panels also store three preference values in localStorage on your device: your theme choice, your font-size choice, and whether the sidebar is expanded. These hold no vault content and are not sent anywhere beyond the ordinary page requests to that panel.

6. Community web app (/app/) and guest page (/g/)

The community web app at /app/ and the guest file-sharing page at /g/ set no cookies. Both open a browser database (IndexedDB) on every visit to hold a short-lived session credential. This does not include your vault keys or the contents of your files. This storage is necessary to deliver the service you asked for, so it does not require the consent a cookie banner would otherwise collect (§ 25(2) Nr. 2 TDDDG).

Decryption of a shared file on /g/ happens in memory only and is never written to disk.

7. App storage (mobile and desktop app)

Outside the browser, the app stores data on your device: preferences such as your crash-report choice, the version of these legal pages you last saw, and your theme choice; a local encrypted copy of your vault for offline use; your key material, in your device’s secure storage; and your push-notification token. This storage, too, is necessary to deliver the service you asked for and does not require separate consent (§ 25(2) Nr. 2 TDDDG).

Deleting your account wipes the local database, the secure key storage and any cached files on that device. Some preferences are not cleared by account deletion, including your crash-report choice and the cached copies of these legal pages; they are removed only if you uninstall the app or clear its storage.

8. No analytics or tracking

Relocat does not set tracking, analytics, advertising or fingerprinting cookies of any kind. No third-party script runs on relocat.org, the Rights Map, the community web app or the guest page.

9. Version

Version 7.1 (October 2026): Editorial. Adds section 4 on the Rights Map at /map/, which keeps your answers in one localStorage entry that never leaves your browser, and how to delete it. The later sections are renumbered. No change to what the rest of the site stores.

Version 7 (September 2026): Corrects two claims from the previous version. The community web app at /app/ and the guest page at /g/ do open a browser database on every visit; the previous version said they wrote nothing to it. The staff panels write three additional preference values to localStorage, and do not clear the CSRF cookie on sign-out. Adds a new “App storage” section describing what the mobile and desktop app keeps on your device outside the browser, and what survives deleting your account.