Cookies and browser storage
In short: this site uses no cookies and stores nothing permanently in your browser. Short-lived records exist only while you sign in and while you stay signed in within a tab, and they are necessary for the sign-in you asked for. That is why we show no cookie consent banner: strictly necessary storage needs no consent (Article 5(3) of the ePrivacy Directive 2002/58/EC and the Croatian law implementing it).
1. This site ({{app_host}})
- Cookies: we set none.
- Sign-in tokens are kept only in the memory of the open page. They disappear when you close the tab, reload the page or sign out.
- Signed-in marker: after you sign in, the page saves one record named
labeling-signed-inwith the value1in the tab's session storage (sessionStorage). It holds no token and nothing about you; it only tells the page, when you reload it, to ask the sign-in server whether you are still signed in, so a reload does not sign you out. The browser deletes it when you close the tab, and the page deletes it when you sign out or your sign-in has expired. Other tabs do not see it. - Sign-in return record: when you click "Sign in", the sign-in library (Keycloak JS) saves one record whose name starts with
kc-callback-in the browser's local storage (localStorage). It holds random one-time values used to check that you are returning from a sign-in you started yourself (state, nonce and a PKCE verifier). The record is deleted as soon as you return from signing in. If you abandon the sign-in, it expires after one hour and is deleted on your next visit. When it starts, the library also briefly writes and immediately deletes a test recordkc-test. If local storage is disabled in your browser, the same short-lived record is kept in a cookie of this site for at most one hour. - Your language choice is not saved in the browser. Choosing English adds
?lang=ento the page address, so a reload keeps it; Croatian is the default.
Purpose: to carry out the sign-in you requested. Strictly necessary; no consent needed.
2. Sign-in server ({{identity_host}})
Sign-in is handled by a Keycloak server at {{identity_host}}. When you sign in, it sets the cookies it needs for signing in on its own address:
| Name | Purpose | Lifetime |
|---|---|---|
AUTH_SESSION_ID, KC_AUTH_SESSION_HASH | link the steps of one sign-in | until the browser is closed |
KC_RESTART | lets an interrupted sign-in continue | until the browser is closed |
KEYCLOAK_IDENTITY, KEYCLOAK_SESSION | remember that you are signed in, so you do not have to sign in on every page | until you sign out or the sign-in session ends (by default at most 10 hours, or 30 minutes of inactivity) |
Some server versions also set the same cookies with a _LEGACY suffix for older browsers. Names can differ slightly between versions; all of them serve sign-in only. Strictly necessary; no consent needed.
3. Google
Signing in with a Google account happens on Google's pages (accounts.google.com), where Google sets its own cookies. Google is responsible for them as an independent controller. See policies.google.com/technologies/cookies.
4. How to remove these records
Signing out ends your session on the sign-in server. You can also delete all records at any time in your browser settings (clear site data).
5. Changes
If we ever start storing anything else in your browser, we will first update this notice, and we will ask for your consent to anything that is not strictly necessary.