Cookie policy

The public marketing site does not create an Eutetic login session and does not use analytics, advertising, or profiling cookies.

When you log in on app.eutetic.com, strictly necessary host-only session cookies keep you authenticated. Security-sensitive forms also load Cloudflare Turnstile to reduce automated abuse.

On login, Eutetic sets:

• A Secure, HttpOnly, SameSite=Lax, host-only session cookie containing only a random opaque handle. Provider access and refresh tokens are not stored in the browser cookie.
• A separate Secure, SameSite=Lax, host-only anti-CSRF cookie. The application must echo it in a request header, and the server verifies that it belongs to the opaque session. It must be readable by the application for that comparison, so it is intentionally not HttpOnly.
• Short-lived, HttpOnly replay cookies may retain only a signed idempotency key and request hash for up to 24 hours. They contain no password, provider token, prompt, or chat content.

These cookies are first-party and are sent to app.eutetic.com, not eutetic.com or unrelated subdomains. The session expires after seven days without activity and no later than 30 days after login. Logging out revokes the server record and clears the current browser session.

Login, signup and password-recovery forms load Cloudflare Turnstile from challenges.cloudflare.com. The managed challenge evaluates browser and interaction signals and returns a short-lived, one-use token that our authentication service validates. Turnstile pre-clearance is not enabled by Eutetic, so the widget is not used to create a cf_clearance cookie.

The home-page video is served by Eutetic rather than embedded from a video platform. There is no browser analytics script, tag manager, advertising script, social button, or tracking pixel. Optional product analytics, when enabled in account settings, sends allowlisted events through the application backend and does not use a tracking cookie.

This is the part worth reading, because it is a conclusion and not a preference.

Article 5(3) of the ePrivacy Directive (2002/58/EC) says that storing information on a user's device requires consent — but it carves out storage that is strictly necessary in order to provide a service the user has explicitly asked for. The Garante's cookie guidelines of 10 June 2021 say the same in Italian practice: technical cookies need an information notice, not consent, and session cookies that keep a login alive are the textbook example.

Our session cookie is exactly that. You asked to log in; the cookie is what makes being logged in possible; without it the service you requested does not work. It is strictly necessary, so it needs no consent — and since there is nothing else on this site to ask you about, a banner would have nothing to ask.

So this site has a cookie page, which is required, and no cookie banner, which is not. A banner offering a choice that does not exist is not compliance; it is noise.

The reasoning above holds only while the list above stays as short as it is. If anything is ever added to this site that stores or reads information on your device beyond what is strictly necessary, consent becomes mandatory and a banner has to appear before that thing loads.

That includes analytics, embedded video, embedded maps, social buttons, chat widgets, advertising and any measurement pixel.

Whoever adds one of those is the person who has to add the banner, update this page, and stop the new thing from loading until consent is given. Please treat this paragraph as part of the definition of done.

The straightforward way is not to log in — no login, no cookie. If you are logged in, logging out clears it.

Every browser also lets you see, block and delete cookies from its settings, and you can do that here at any time. Fair warning: block this one and the login stops working, because it is the mechanism by which the login works. That is not a penalty for refusing, it is the same fact stated from the other side.

The session cookie is personal data, so the privacy policy applies to it: who the controller is, how long we keep it, and your rights over it are all set out there.

Questions about this page go to [email protected].