| Strictly necessary | Authentication and session cookies | Auth.js session cookies and short-lived admin access cookies | Keep authenticated areas available, protect account sessions, and preserve requested sign-in flows. | Necessary for the requested service and security-related legitimate interests. | Session or limited duration, depending on the cookie |
| Strictly necessary | Privacy preference cookies | rp_privacy_subject and rp_privacy_consent | Remember the privacy subject identifier and the latest analytics choice so optional analytics stays off until the user opts in. | Necessary to honour the user’s privacy preference and document the current choice. | Up to 12 months for the subject cookie and up to 180 days for the consent state cookie |
| Functional storage | Local preferences | report-theme, report-lang, report-avatar, report-username, report-country | Remember interface, display, and local profile preferences the user actively selected on this device. | Necessary to provide the setting or function requested by the user. | Until changed or cleared by the user |
| Functional storage | Local product state | Saved watchlists, local report state, and cached company branding where available | Keep optional product conveniences locally on the device without sending them to Google Analytics. | Necessary to provide the selected feature or user action. | Until changed, refreshed, or cleared by the user |
| Optional analytics | Google Analytics 4 (Google LLC) | _ga, _ga_<container-id>, _gid, _gat | Measure aggregated traffic and broad usage trends only after the user actively accepts analytics. IP addresses are anonymised and Google Signals / ad personalisation are disabled. | Consent | _ga and _ga_<container-id>: up to 2 years · _gid: 24 hours · _gat: 1 minute. Set only after consent is granted; removed when analytics is refused or withdrawn. |