What has been found
The inspected portal uses authentication and security cookies plus browser storage for preferences and application work. No advertising or optional analytics was identified in the inspected portal code. This is a code-review finding, not a completed production network audit.
| Item | Purpose | Observed or proposed duration |
|---|---|---|
__Host-session |
Secure login; HttpOnly, Secure, SameSite=Lax | 900 seconds; renewed with qualifying activity |
__Host-csrf |
Protect authenticated changes against cross-site requests; Secure, SameSite=Lax | 900 seconds; renewed with qualifying activity |
_streamlit_xsrf / Streamlit security cookies |
Protect the planning module | [Confirm names, attributes and actual expiry in the production browser/network audit] |
maritime.theme, stowmate.workspace.theme.v1 |
Remember the user’s chosen colour theme | Browser local storage until cleared; no fixed expiry identified |
cmw.sidebarCollapsed, chiefmate.buttonHints.v1 |
Remember navigation and help preferences | Browser local storage until cleared; no fixed expiry identified |
cmw.applicationMode, cmw.serverAddress |
Remember an explicitly selected offline/server mode | Browser local storage until cleared; no fixed expiry identified |
stowmate-visibility:* |
Remember user-entered visibility-preview settings | Browser local storage until cleared; no fixed expiry identified |
stowmate-draft:* |
Recover unsaved planning changes | Session storage; normally the browser tab session, subject to browser restoration behaviour |
| Saved folder handle / application data | Support selected offline folders and local records | [Audit IndexedDB and offline-module stores per release; document clearing and recovery behaviour] |
Is a consent banner required?
Under national rules implementing ePrivacy Article 5(3), access/storage strictly necessary for a service explicitly requested by the user can be exempt from prior consent. Login/security storage may qualify. Preference or local-storage mechanisms are not automatically exempt merely because they are first-party or not called cookies; assess the purpose, trigger and national rules.
Provisional position: do not add a meaningless “Accept all” banner. Before public launch, confirm that every automatic storage/access operation is exempt, or change the implementation to obtain the required prior choice. If only qualifying necessary/requested functions remain, publish this notice without a consent banner. If optional analytics, advertising, tracking, non-exempt preferences or external embeds are introduced, block the relevant operations until valid consent; provide an equally accessible rejection and withdrawal mechanism. Scrolling or continuing to browse is not consent.
Your choices
You can change appearance and Button hints in Settings and clear cookies/site data through your browser. Clearing authentication data signs you out. Clearing local application storage or drafts can remove recoverable work; export or back up records first. No consent-management interface is claimed as implemented by this draft. [Record the production audit, legal classification of each item, duration and any required consent controls.]
Contact: info@stowmate.pro. ePrivacy text; EDPB technical-scope guidance.