Storage used to provide requested features
Essential or user-requested storage supports authentication, security, selected preferences, temporary drafts, and offline delivery. Whether a legal exemption applies depends on purpose and jurisdiction, not the storage technology’s name.
| Storage | Purpose | Typical duration / scope |
|---|---|---|
| WorkOS/AuthKit session cookies | Maintain dashboard authentication and session security. | Controlled by the deployed AuthKit session configuration. Confirm actual cookie names, renewal, and expiry in production. |
| __cf_bm (Cloudflare) | Help the public website’s edge protection distinguish automated traffic. | Observed on live public responses with about 30-minute expiry; Cloudflare documents expiry after 30 minutes of continuous inactivity. Other challenge cookies may appear when challenges are used. |
| ug-invite-intent | Carry the invitation securely through the authentication redirect. | Up to 30 minutes in the current dashboard configuration. |
| __Host-ug-portal (ug-portal in development) | Maintain the visitor’s authenticated portal session; production cookie is Secure, HttpOnly, and SameSite. | Up to 30 days as currently configured; portal-host scoped. Signing out ends the current session. |
| Theme and app-selection local storage | Remember the chosen appearance and selected workspace/app. | Browser-local until cleared, replaced, or removed by the application. |
| Onboarding/session storage | Remember setup choices, temporary setup keys, and current-session progress. | Browser-tab session, subject to browser restoration behaviour. |
| Portal draft session storage | Keep unfinished requests or support replies through navigation/reload. | Browser-tab session; some drafts are cleared on successful submission or sign-out. Do not use a shared device for confidential drafts. |
| SDK IndexedDB / platform storage | Keep app-scoped identity, consent, offline queues, and survey progress for enabled features. | Depends on SDK, retention limits, reset, and the host app. The web SDK remains inactive until explicit participation. |
| usergist:privacy:v1 local storage | Remember the dashboard analytics choice and its notice version. | Up to 180 days before a fresh choice is requested. Restricted storage falls back to the current tab’s memory. |
Optional dashboard analytics
The revised dashboard loads Amplitude only after an affirmative analytics choice. Rejecting or leaving the choice unanswered keeps it off. Analytics covers explicit product events and limited identifiers; automatic click/form capture and session replay are disabled. Optional analytics uses memory-only SDK persistence in this implementation, so it does not intentionally create Amplitude identity cookies or persistent event storage.
The preference notice offers “Allow analytics” and “Reject optional” with equal access. You can reopen preferences from the dashboard’s privacy control or Account settings. Withdrawal stops future event submission; it does not delete information already received by a vendor. Use the data-rights process for historical information.
Global Privacy Control or Do Not Track keeps optional analytics off, including when an older saved choice allowed it. A notice-version change or expiry requires a fresh choice. This choice applies to this browser origin; it is not an organisation-wide or cross-device preference.
The public website and customer portals
The checked public marketing website does not initialise the dashboard’s Amplitude analytics. Its live edge responses can set Cloudflare security cookies. The dashboard also currently requests a Google Fonts stylesheet for SDK previews; a font request can disclose network metadata even without an analytics cookie. The revised portal links to this information, but each customer remains responsible for its own notices and additional technologies.
Embedded or external content and links may lead to services with their own storage and privacy practices. Loading an optional third-party tool should be assessed before adding it. A cookie banner is not required solely because a site uses only genuinely exempt storage; adding non-exempt tracking changes that assessment.
Manage and clear storage
- Use dashboard privacy preferences to change analytics consent without affecting core access.
- Use browser settings to inspect or clear cookies and site storage. This can sign you out, discard drafts, or reset preferences.
- In an app integrating UserGist, use that app’s privacy settings for SDK consent and device notification settings for operating-system push permission.
- Resetting an SDK or clearing browser storage does not erase server-side data. Request deletion from the responsible organisation when needed.
You can save or print this document using your browser’s print menu. Keep the version and draft status with any copy.