Cookies and browser storage
In short: this site uses no cookies and stores nothing permanently in your browser. Short-lived records exist only while you sign in, and they are necessary for the sign-in you asked for. That is why we show no cookie consent banner: strictly necessary storage needs no consent (Article 5(3) of the ePrivacy Directive 2002/58/EC and the Croatian law implementing it).
1. This site ({{app_host}})
- Cookies: we set none.
- Sign-in tokens are kept only in the memory of the open page. They disappear when you close the tab, reload the page or sign out.
- Sign-in return record: when you click "Sign in", the sign-in library (Keycloak JS) saves one record whose name starts with
kc-callback-in the browser's local storage (localStorage). It holds random one-time values used to check that you are returning from a sign-in you started yourself (state, nonce and a PKCE verifier). The record is deleted as soon as you return from signing in. If you abandon the sign-in, it expires after one hour and is deleted on your next visit. When it starts, the library also briefly writes and immediately deletes a test recordkc-test. If local storage is disabled in your browser, the same short-lived record is kept in a cookie of this site for at most one hour. - Your language choice is not saved: it lasts only while the page is open.
Purpose: to carry out the sign-in you requested. Strictly necessary; no consent needed.
2. Sign-in server ({{identity_host}})
Sign-in is handled by a Keycloak server at {{identity_host}}. When you sign in, it sets the cookies it needs for signing in on its own address:
| Name | Purpose | Lifetime |
|---|---|---|
AUTH_SESSION_ID, KC_AUTH_SESSION_HASH | link the steps of one sign-in | until the browser is closed |
KC_RESTART | lets an interrupted sign-in continue | until the browser is closed |
KEYCLOAK_IDENTITY, KEYCLOAK_SESSION | remember that you are signed in, so you do not have to sign in on every page | until you sign out or the sign-in session ends (by default at most 10 hours, or 30 minutes of inactivity) |
Some server versions also set the same cookies with a _LEGACY suffix for older browsers. Names can differ slightly between versions; all of them serve sign-in only. Strictly necessary; no consent needed.
3. Google
Signing in with a Google account happens on Google's pages (accounts.google.com), where Google sets its own cookies. Google is responsible for them as an independent controller. See policies.google.com/technologies/cookies.
4. How to remove these records
Signing out ends your session on the sign-in server. You can also delete all records at any time in your browser settings (clear site data).
5. Changes
If we ever start storing anything else in your browser, we will first update this notice, and we will ask for your consent to anything that is not strictly necessary.