Cookies and local storage
Which cookies lets-onboard sets, what the app keeps in your browser, and why. No consent banner, because nothing here needs one.
1. In short
- lets-onboard sets two cookies, and only once you sign in. The session cookie keeps you signed in. It is strictly necessary for the service you asked for, so Danish law lets us set it without asking for consent, and we don't. The mode cookie is set only if you choose Dark under Appearance in the top bar, and remembers that choice on this device.
- There are no analytics, advertising or tracking cookies, and no third-party cookies. The public pages and the demos set no cookie at all.
- The app keeps a few things in your browser's own storage so that work isn't lost on a reload. Two of them are sent to lets-onboard when they are saved; the rest never leave your browser. All of them are removed when you sign out.
2. The rules we follow
Storing anything in your browser is governed in Denmark by the cookie order (bekendtgørelse nr. 1148 af 9. december 2011 om krav til information og samtykke ved lagring af eller adgang til oplysninger i slutbrugeres terminaludstyr), which implements article 5(3) of the EU ePrivacy Directive (2002/58/EC). Its § 3 asks for informed consent before anything is stored in or read from your device. Its § 4 makes an exception for storage that is required to provide a service you have explicitly asked for, and the Danish Agency for Digital Government's guidance names sign-in and user validation as the typical case. The session cookie is exactly that: without it, the page after your sign-in link could not know it is you. For such a cookie the order requires neither consent nor a notice. The mode cookie rests on the same exception: it is stored only when you choose a mode under Appearance in the top bar, which is the service you explicitly ask for, and it holds nothing but that choice. We describe both here anyway, so that you know what is stored, and because the data protection rules (GDPR article 13) require us to say how we handle the personal data the session cookie connects to, which the privacy policy does.
3. Cookies
| Cookie | Purpose | Lifetime | Details |
|---|---|---|---|
__Host-lo_session | Keeps you signed in after you open a sign-in or invitation link. | Your browser keeps it for 30 days at most. The session it belongs to ends when you sign out, after 7 days without use, and after 30 days whatever happens; after that the cookie no longer works. | First-party and strictly necessary. Holds a random value; the server stores only a SHA-256 hash of it. Sent over encrypted connections only, to this site only, and not readable by scripts on the page (Secure, HttpOnly, SameSite=Lax, Path=/). |
__Host-lo_theme | Remembers whether you chose light or dark mode. | 365 days after your last visit signed in (in Safari, 7 days); deleted when you choose “Light — as designed” under “Appearance” in the top bar. | First-party. Set only when you choose a mode; holds “light” or “dark”; not linked to your account. Readable by the page, so the mode can change without a reload (Secure, SameSite=Lax, Path=/). |
Signing out deletes the session cookie and the session it belongs to. Signing in again replaces it. If you block the session cookie, you can still read the public pages and use the demos, but you can't sign in. Signing out keeps the mode cookie: it is this device's choice, not your account's, so the sign-in page keeps the mode. If you block the mode cookie, the pages keep their default look.
4. What the app keeps in your browser
Signed-in pages use your browser's local and session storage for the things below, each under a key that starts with lets-onboard:. Items kept for a learner are keyed to that learner's account, so another person on the same computer never finds them. Everything is removed when you sign out from the account menu. If your session simply expires, the items stay in your browser until you sign out, sign in and out again, or clear your browser's site data.
| What | Who | Why | Leaves your browser? | How long |
|---|---|---|---|---|
| Unsaved course edits | Admins | If a change in the course editor can't reach the server, it is kept here so it isn't lost. | Yes: it is saved to lets-onboard when the connection is back. | Until it is saved, or you sign out. |
| A build that is running | Admins | Lets the build page pick up a running build after a reload (this browser tab only). | No. | Until the build finishes, the tab closes, or you sign out. |
| Learning progress not yet saved | Learners | If your session ended while you were learning, the progress the server could not save is kept here. | Yes: it is saved to lets-onboard when you sign in again. | Until you sign in again, or you sign out. |
| A final assessment in progress | Learners | Your answers so far, so a reload doesn't send you back to the start. | No. Only the attempt you submit is sent, as it would be anyway. | Until you submit the attempt, or you sign out. |
| Tries at a practice task | Learners | Which tasks you tried and got wrong, or used a hint on, before finishing them, so a later run can't be counted as right first time. | No. | Until the task is finished, or you sign out. |
| Whether Ask is open, and which of its first-time lines you have seen | Admins, and visitors to the demo | So the panel comes back the way you left it, and a line is said once. | No. | Until you sign out, or clear your browser's site data. |
| The public demo | Anyone | What you do in the demo, so a reload keeps your place (this browser tab only). | No. The demo stores nothing on our side. | Until the tab closes. |
5. No third-party requests
The pages load their fonts, images and scripts from lets-onboard itself, and the browser is told to refuse anything else (a Content-Security-Policy that allows only this site). No page embeds content from other sites or sends information about your visit to anyone else. The connection itself passes through our hosting and network providers, which the privacy policy names.
6. Your choices
You can delete cookies and site data in your browser's settings at any time; you will then need a new sign-in link. How we handle personal data, and your rights, are in the privacy policy.
7. Changes
If lets-onboard ever needs another cookie, or needs consent for one, this page will say so before it is used, and the date at the top will change. Changes that matter to you are announced to your company's admins as the terms of service describe.