Cookie Policy
This notice describes cookies used on decret.ai.
Contents
1. Cookies used
Decret sets, on decret.ai, strictly necessary first-party cookies required for operation of the website, authentication, and the language you read the site in, and a first-party cookie remembering your analytics choice. Advertising cookies, social-media pixels, and cross-site tracking cookies are not set. Google Analytics 4 runs on the public pages only while Decret has it switched on, and then only after you accept it in the banner, which is shown only while it is on; no request is made to Google before you accept. The controller responsible for these cookies is named in the Privacy Policy.
In production, authentication cookie names are prefixed with __Host- (Secure, Path=/, no Domain attribute). In local development the unprefixed names may appear.
2. Cookie schedule
| Name | Purpose | Duration | Provider |
|---|---|---|---|
decret_sessionor __Host-decret_session | Authentication. HttpOnly. Contains a session token. The server stores a hash of the identifier, not the password. | Up to thirty (30) days absolute; idle timeout fourteen (14) days (sliding). Cleared on logout or password change (other devices signed out). | Decret |
decret_consent | Remembers your analytics choice (analytics=granted or analytics=denied). Readable by page scripts. Not HttpOnly. | One hundred and eighty (180) days, or until you change the choice. | Decret |
decret_locale | Remembers the language of the site and the workspace (en or ro). Set on your first visit and when you choose a language, so that pages open in that language. Not HttpOnly. | One (1) year, renewed when you choose a language. | Decret |
_ga | Google Analytics 4. Distinguishes visitors. Set only where you accepted analytics. | Up to two (2) years. | Google (only after you accept) |
_ga_<container-id> | Google Analytics 4. Maintains the state of the analytics session. Set only where you accepted analytics. | Up to two (2) years. | Google (only after you accept) |
The browser may store ordinary HTTPS state. The network edge (including Cloudflare) may set cookies required for bot management. Those cookies are not used by Decret to build a marketing profile. Cookies not set by Decret are not scheduled in this notice.
Inside the signed-in workspace the browser also keeps, on your device, what the workspace needs to work as you use it: pages you opened, kept so the workspace can open without a connection; entries captured offline until they are sent; and small preferences such as the last project you used. This storage is not shared with anyone and is not used for analytics. Signing out clears the kept pages and the remembered account.
Cookies may be deleted in the browser. Deletion of the session cookie requires subsequent authentication. Revoking analytics removes the Google cookies on a best-effort basis and stops further analytics requests.
3. Legal basis
Strictly necessary cookies do not require consent under the ePrivacy rules (PECR in the United Kingdom). They are used to provide a service requested by the user (use of the site; maintenance of an authenticated session). Analytics cookies are set on the basis of consent, which you give or refuse in the banner and may withdraw at any time via the cookie settings link in the footer. Legal bases under the EU GDPR and the UK GDPR are set out in the Privacy Policy.
4. Changes
This notice shall be updated if additional cookies are used. See also the Privacy Policy, Terms of Service, and Security Measures.