Cookies

No cookies of our own

The code of this site, of the Trame, Gouvernail and Pilote applications, of the account area and of the three widgets writes no cookies. Authentication does not use a cookie but an Authorization header.

So there is no consent banner on this site, and that is no oversight: no audience measurement, no advertising tracker, no pixel, no social media button. This site's fonts are served from our own servers.

The only third party that sets cookies is Stripe, in the account area, when you open the card form (see below).

What the suite does use is the browser's local storage (localStorage, sessionStorage), to remember a preference, keep a session open or avoid losing text being written. Article 82 of the French Data Protection Act treats these technologies like cookies: they must therefore be declared, which the rest of this page does.

What a cookie is, and what comes close

A cookie is a small file a site places on your device, which your browser sends back with every request to that site. That automatic return is what makes cookies the natural tool for tracking across sites.

Local storage serves the same memory purpose but works differently: the data stays on your device and is never sent automatically. It is only read by code from the domain that wrote it, and only when that code asks for it. localStorage persists until cleared; sessionStorage disappears when the tab is closed.

None of the keys listed below can be used to follow you from one site to another.

On this site

dismoi.themelocalStorage, until cleared

The light or dark theme you chose. If absent, the page follows your system setting.

dismoi.langlocalStorage, until cleared

The language you chose, French or English.

ckf-pos:<widget key>localStorage, until cleared

The corner the user moved the launcher to.

ckf-draft:<widget key>sessionStorage, until the tab is closed

The draft of the feedback being written (comment and address if entered), to survive an accidental close of the panel. Cleared on sending or as soon as the field is empty.

ckf-visitor:<widget key>localStorage, until cleared

The visitor's pseudonymous identifier, issued by our servers when a conversation is opened, to find the thread again from one visit to the next.

ckf-threads:<widget key>localStorage, until cleared

The marker that a conversation exists on this device: without it, no unread-messages request is sent when the page loads.

The first two are written by your own action: a click on the theme or language switch. The next four are written by the Trame widget this site runs on itself, and only if you use it; the last two only if you open a conversation.

None of these keys reach us. They live in your browser, and no code on this page sends them to a server.

In the applications and the account area

If you have an account, each application keeps the following data on your device, under its own domain. It only concerns you, as a member of an organisation, never the visitors to your site.

Account area

dismoi_compte_access_tokenlocalStorage, until you sign out

The token that keeps you signed in from one visit to the next.

dismoi_compte_refresh_tokenlocalStorage, until you sign out

The token that renews the previous one without asking for your password again.

dismoi_compte_pending_emailsessionStorage, until the tab is closed

The address awaiting verification, so the code step can resume if the page is reloaded during sign-up.

dismoi_compte_sso_statesessionStorage, until the tab is closed

During a sign-in through an identity provider, the value that ties the return to the start and the page to come back to. Cleared on return.

compte.schemelocalStorage, until cleared

Light, dark or automatic theme.

compte.localelocalStorage, until cleared

Interface language.

Trame

ckfeedback_access_tokenlocalStorage, until you sign out

The token that keeps you signed in from one visit to the next.

ckfeedback_refresh_tokenlocalStorage, until you sign out

The token that renews the previous one without asking for your password again.

ckfeedback_pending_emailsessionStorage, until the tab is closed

The address awaiting verification, so the code step can resume if the page is reloaded during sign-up.

ckfeedback_sso_statesessionStorage, until the tab is closed

During a sign-in through an identity provider, the value that ties the return to the start and the page to come back to. Cleared on return.

trame.schemelocalStorage, until cleared

Light, dark or automatic theme.

trame.localelocalStorage, until cleared

Interface language.

ckfeedback_triagelocalStorage, until cleared

The filters of your triage queue, per project, so you find your view again when you come back. Beyond twenty projects, the oldest are forgotten.

Gouvernail

gouvernail_access_tokenlocalStorage, until you sign out

The token that keeps you signed in from one visit to the next.

gouvernail_refresh_tokenlocalStorage, until you sign out

The token that renews the previous one without asking for your password again.

gouvernail_pending_emailsessionStorage, until the tab is closed

The address awaiting verification, so the code step can resume if the page is reloaded during sign-up.

gouvernail_sso_statesessionStorage, until the tab is closed

During a sign-in through an identity provider, the value that ties the return to the start and the page to come back to. Cleared on return.

gouvernail.schemelocalStorage, until cleared

Light, dark or automatic theme.

gouvernail.localelocalStorage, until cleared

Interface language.

Pilote

catai_access_tokenlocalStorage, until you sign out

The token that keeps you signed in from one visit to the next.

catai_refresh_tokenlocalStorage, until you sign out

The token that renews the previous one without asking for your password again.

catai_pending_emailsessionStorage, until the tab is closed

The address awaiting verification, so the code step can resume if the page is reloaded during sign-up.

catai_sso_statesessionStorage, until the tab is closed

During a sign-in through an identity provider, the value that ties the return to the start and the page to come back to. Cleared on return.

pilote.schemelocalStorage, until cleared

Light, dark or automatic theme.

pilote.localelocalStorage, until cleared

Interface language.

The intermediate token of two-step sign-in is never written to the device: it only lives in memory, while you enter the code.

The widgets, on your site

If you install one of the suite's widgets, here is exactly what it writes on your visitors' devices, under your domain. The list contains zero cookies.

Trame widget

ckf-pos:<widget key>localStorage, until cleared

The corner the user moved the launcher to.

ckf-dock-shelflocalStorage, until cleared

Whether the annotation toolbar is expanded or collapsed.

ckf-draft:<widget key>sessionStorage, until the tab is closed

The draft of the feedback being written (comment and address if entered), to survive an accidental close of the panel. Cleared on sending or as soon as the field is empty.

ckf-visitor:<widget key>localStorage, until cleared

The visitor's pseudonymous identifier, issued by our servers when a conversation is opened, to find the thread again from one visit to the next.

ckf-threads:<widget key>localStorage, until cleared

The marker that a conversation exists on this device: without it, no unread-messages request is sent when the page loads.

The last two are only written if you offer conversation (chat in data-types) and the visitor opens one; the widget offers to clear them itself (“Clear my conversations from this browser”).

Gouvernail widget

gouvernail:sessionsessionStorage, until the tab is closed

The current sharing session, once the visitor has accepted it: it follows them from page to page in this tab and dies with it. The Trame widget reads it when sharing was started from a conversation.

gouvernail:config:<site key>sessionStorage, until the tab is closed

Whether the help button is shown on this site, so it is not asked again on every page.

Pilote widget

catai.panelsessionStorage, until the tab is closed

Whether the panel is open or closed, so it is found the same way on the next page.

Every storage access is guarded against failure: if the visitor blocks it, the widget still works and only loses that memory.

Since these keys are necessary for a service the visitor asked for, in our analysis they fall under the Article 82 exemption. The assessment nonetheless belongs to the data controller, that is to you: the GDPR page explains this split.

Two third parties, in the applications only

Stripe, our payment provider, is only loaded in the account area, at two moments: when you open the form to add a card, and when you resume a payment your bank asks you to confirm. Its script is loaded nowhere else, neither on this site nor in the three applications. Once loaded, it sets its own cookies and collects fraud-prevention signals that are essential to the payment you request. See Stripe's cookie policy and its privacy policy.

Google Fonts: the Trame, Gouvernail and Pilote applications and the account area currently load their font from Google's servers, which sends your IP address to Google. This site does not: its fonts are self-hosted. Bringing the applications in line with this principle is still to be done.

Why no consent is requested

Article 82 of the French Data Protection Act requires prior consent for reading and writing on the user's device, except where the operation is strictly necessary to provide a service the user explicitly asked for, or where its sole purpose is to enable or facilitate communication.

The CNIL's guidelines place within this exemption remembering a choice the user made (language, display), authentication to a service and keeping a form in progress. The keys above have no other purpose: none is used for audience measurement, advertising or profile matching.

Clearing this data

You can delete it at any time, without asking us:

• In your browser: privacy settings let you clear a site's data, called “site data”, “local storage” or “cookies and site data” depending on the browser.
• From the developer tools: the Application or Storage tab, then delete the keys listed above.
• In private browsing: nothing survives closing the window.
• By signing out of an application: its two tokens are cleared.

These settings are specific to each device and browser. The CNIL publishes guides per browser (in French).

Updates

This page is kept up to date with the code. If a key appears, disappears or changes purpose, it changes here, and the date at the top of the page shows it. If you notice a gap between this list and what your browser contains, tell us: it is a defect, and we want to know.