Legal
Cookies
Every cookie this service sets is strictly necessary for signing in and staying signed in. None is used for analytics, advertising or tracking, which is why you have not been asked to consent to anything.
This document is a working draft prepared by the product team. It has not been reviewed or approved by qualified legal counsel in any jurisdiction, and it is not in force. It must be reviewed, completed and adopted before this site is published to a live domain or any customer relationship is entered into. Bracketed text marks information that only the operating entity can supply.
What is set
| Name | Purpose | Lifetime |
|---|---|---|
| dunai_access | Holds the short-lived session token that authenticates requests to the assessment service. | Minutes; session |
| dunai_refresh | Allows a session to be renewed without signing in again. Revoked on sign out. | Days |
Both are set with HttpOnly, so browser scripts cannot read them; SameSite=Lax, so they are not sent with cross-site requests; and Secure wherever the service is served over HTTPS. Together these mean a cross-site scripting flaw cannot lift a session, and a malicious site cannot borrow one.
What is deliberately absent
- No analytics of any kind, first-party or third-party
- No advertising, remarketing or conversion tracking
- No social media embeds or share widgets
- No externally hosted fonts, images or scripts
- No session recording, heatmaps or behavioural measurement
A restrictive content security policy is served with every page, so a third-party request would be blocked by the browser even if one were introduced by mistake. Privacy notice →