Cookie Policy

Zuletzt aktualisiert: 2026-10-08

Version db508021ee92

Dieses Dokument wird auf Englisch veröffentlicht. Maßgeblich ist die englische Fassung.

The three categories

Category	Purpose	Consent needed
Strictly necessary	Login session, security, and rendering the page in the language and theme you chose	No
Analytics	Google Analytics 4 — which pages are read	Yes
Marketing	None set at present. This row exists so that adding one is a visible change.	Yes

There is no “functional” category, because there is no functional script. The theme and the language are what render the page you asked for, so they sit in the strictly-necessary set and are named individually below rather than hidden inside a category.

Every cookie we set

Measured on the deployed site with the browser’s own cookie store, which sees the HttpOnly entries a page script cannot. All of these are first-party cookies set by clavix360.app.

Name	Set by	Purpose	Lifetime	Consent
clavix_token	Clavix 360°	Your signed-in session. HttpOnly, Secure, SameSite=Lax. Carries an access token that itself expires hourly and is replaced automatically.	7 days, or 30 with “remember me”	Not needed
clavix_refresh	Clavix 360°	Renews the session without a fresh sign-in every hour. HttpOnly, Secure, SameSite=Lax.	7 or 30 days, matching the above	Not needed
clavix_remember	Clavix 360°	Records which of the two session lengths applies, so renewal keeps it.	7 or 30 days	Not needed
clavix_mfa	Clavix 360°	A ticket between the password step and the second factor, where two-factor sign-in is enabled.	10 minutes	Not needed
clavix_oauth_state	Clavix 360°	Cross-site request forgery protection for the Google sign-in round trip. Scoped to /api/auth/google.	10 minutes	Not needed
NEXT_LOCALE	Clavix 360°	The language you are reading in. Set when you are on a locale other than English, or when you use the language switcher.	The browsing session; 365 days if you chose the language yourself	Not needed
googtrans	Google	Target language for Google’s website translation widget. Set ONLY if you choose a country whose language we do not publish ourselves.	The browsing session	Needed, and only set on your explicit request
_ga	Google	Google Analytics 4 client identifier — a random value for your browser.	Up to 2 years	Needed
_ga_862VWG476M	Google	Google Analytics 4 session state for this property.	Shorter than _ga; set by Google’s configuration	Needed

The two _ga cookies appear when, and only when, you consent to analytics, and switching analytics off deletes both. Google’s script is not requested from our pages before consent at all, so there is no stage at which a tag is loaded and asked not to measure.

Storage that is not a cookie

Some preferences are kept in the browser’s local or session storage. These are never sent to us — a cookie travels with every request and these do not — and they are listed because what the law governs is storing something on your device, not the word “cookie”.

Key	Where	Purpose	Consent
clavix360-theme	Local storage	Dark or light. Read before the page paints, so the wrong theme does not flash first.	Not needed
cx-cookie-prefs	Local storage	Your cookie choice itself, with the date you made it and the policy version it answers.	Not needed — it is how the choice is honoured
cx-region-country	Local storage	The country chosen in the footer region picker. Written only when you choose one.	Not needed
cx_nav_collapsed, cx_active_dept	Local storage	Whether the dashboard sidebar is collapsed, and the department last worked in. Signed-in users only.	Not needed
cx_scroll:<page>	Session storage	Scroll position, so going back returns you to the same place. Signed-in users only; discarded when the tab closes.	Not needed

We use no IndexedDB, no local shared objects, and no device or browser fingerprinting. Measured: the browser reported no databases on any public page.

Third parties on the public pages

Checked by loading the deployed pages in a browser and reading its network log, rather than by reading our own source.

Fonts are self-hosted. No page makes a request to Google Fonts.
Images, including those stored in our database, are fetched by our server and served from clavix360.app, so your browser does not contact the storage provider.
The Academy and the article pages load YouTube video thumbnails from Google’s image host i.ytimg.com when the page opens. These set no cookies, but the request discloses your IP address and the page you are on to Google. The player itself is not loaded until you press play, and then uses youtube-nocookie.com.
Google’s website translation widget loads only if you choose a country whose language we do not publish.
Signing in with Google contacts Google only when you click that button.

Nothing else on a public page contacts a third party, and before you consent no request of any kind reaches a Google analytics or tag domain.

Managing cookies

A banner asks you to decide on your first visit. Accept all and Reject all are the same size and weight and one click each; rejecting is never the longer path. You can change your choice at any time from the “Manage preferences” link in the footer of any page, or on the cookie preferences page.