Here to Help!
Version 1.0.1 Effective date: 28 August 2026 Last updated: 28 August 2026
This policy explains cookies and related browser storage used on Husika. “Browser storage” includes cookies, local storage and session storage. Husika is the operator and data controller. Contact [email protected] about cookies, privacy or data rights.
A cookie's actual lifetime can be shorter if you sign out, the service replaces or removes it, or you clear browser data. Provider-controlled names and lifetimes can change.
| Name or family | Storage | Purpose | Lifetime or observed attributes | | --- | --- | --- | --- | | `husika_locale` | Cookie and local storage | Remember the EN/SW choice and keep server and browser rendering consistent. | Cookie: up to 1 year, path `/`, SameSite=Lax. Local storage: until removed or browser data is cleared. | | `husika_auth_token` | Cookie and local storage | Keep an authenticated session available to browser and server requests. | Cookie: Secure, SameSite=Strict, path `/`, no explicit expiry (browser session), and readable by JavaScript. Local storage: until logout, removal or replacement. | | `husika_auth_refresh_token` | Local storage | Request a renewed access token. | Until logout, removal, replacement or browser clearing. | | `husika_user` and permission keys | Local storage | Restore signed-in user state and cache permissions. | Until logout, removal, replacement or cache clearing. | | `__Host-husika-survey-participant` | HttpOnly production cookie | Hold an opaque signed anonymous-survey participant token and reduce repeat responses. | Secure in production, SameSite=Lax, path `/`; configurable, with a 180-day fallback. | | `__Secure-husika_google_oauth` | HttpOnly cookie on `api.husika.org` | Protect the temporary Google OAuth flow after you choose Google sign-in. | Production observation: about 5 minutes; Secure, SameSite=Lax, callback path. | | `husika_consent` | First-party cookie | Store a minimal versioned choice for optional analytics and experience categories, plus the decision time. It contains no account or advertising identifier. | Up to 180 days; Secure on HTTPS, SameSite=Lax, path `/`. | | OAuth redirect and pending-comment keys | Session storage | Return to the intended page after sign-in and temporarily preserve a comment draft. | Browser-tab session or earlier removal after use. | | Tour, nudge, quick-action, theme and assistant keys | Local storage | Remember interface choices, dismissals, tour completion, theme and local assistant state. Optional tour and assistant state requires experience consent and is cleared when that consent is withdrawn. | Until code removes or replaces them or browser data is cleared. Some quick-action state has a 24-hour cooldown. |
The anonymous-survey cookie does not prove one-person uniqueness. Clearing it or using another browser or profile can permit another response.
A clean-browser production review on 28 August 2026 confirmed that the site presents equally available accept and reject choices before optional analytics or experience technologies can run.
| Provider / name | What happens | Lifetime or attributes observed | | --- | --- | --- | | Cloudflare Insights RUM | Automatic edge injection is disabled. An app-controlled RUM loader may be used only after analytics consent and only when configured. | No Cloudflare RUM request or cookie was observed before consent in the 28 August 2026 review. | | Vercel public-site experience runtime | Frontend functions remain hosted in US region `iad1`, but the optional `vercel.live` public-site experience runtime was not observed in the 28 August 2026 review. | No `vercel.live` request or optional third-party cookie was observed before consent. |
Husika provides a preference centre for optional analytics and experience categories. Rejecting optional categories keeps them off. You can reopen Cookie preferences in the footer to change or withdraw your choice. Withdrawing consent stops future optional use and clears removable optional browser storage controlled by Husika.
Depending on the activity, processing may rely on consent, providing a requested service, a legal obligation, or legitimate interests in security and platform integrity. The signed-in data-usage setting does not record or control an anonymous visitor's choice for these technologies.
Google OAuth is enabled but is used only after you select Google sign-in. A clean-browser check on 27 August 2026 observed the following Google-controlled cookies on Google's domains. Google controls their operation and may change names or lifetimes.
| Name | Observed purpose/context | Approximate observed lifetime / attributes | | --- | --- | --- | | `__Host-GAPS` | Google account sign-in and security flow. | About 400 days; HttpOnly, Secure, SameSite=Lax. | | `OTZ` | Google sign-in service operation and preferences. | About 30 days; Secure, SameSite=Lax. | | `NID` | Google service preferences, security and related service operation. | About 6 months; HttpOnly, Secure, SameSite=None. |
Google may use additional cookies depending on your existing Google session, choices and Google's changes. Review the information Google presents in its sign-in flow.
Azure Blob Storage is used for assets, but its exact production region is not verified. A Resend email integration exists, but its operational location for Husika is not verified. The AI assistant interface is enabled, but the active provider names and locations are not verified.
No Google Analytics, PostHog, Segment or Mixpanel browser analytics was observed in the production review. There are currently no public document embeds. These observations do not guarantee that future versions will use exactly the same technologies.
You can use browser controls to block or clear cookies, local storage and session storage. Blocking or clearing:
authentication storage can prevent or end sign-in;
language storage can reset your language choice;
the anonymous-survey cookie prevents that flow from maintaining its participant token; and
provider cookies may affect the relevant external service.
Use Cookie preferences in the footer to accept, reject, change or withdraw optional analytics and experience choices without an account. Browser controls remain available for clearing all site data, including necessary storage; doing so may cause the effects listed above.
Husika may update this policy when browser storage, providers or consent controls change. A new version will show its effective and updated dates.
For questions or a data-rights request, email [email protected]. Do not send passwords or authentication tokens by email.