Cookies
Everything KINTAG stores in your browser, what each item is for, and how long it lasts.
The short version
Three cookies, all of them strictly necessary to do something you asked for: stay signed in, keep the colours you chose, keep the language you chose. Nothing here profiles you, nothing is shared, and nothing follows you to another site.
That is also why there is no cookie banner. Under ePrivacy art. 5(3) a cookie needed to provide the service you explicitly asked for does not require consent, and asking anyway would be theatre. Adding an optional cookie would be a decision to need consent — the code derives that rather than trusting this paragraph: `consentBannerRequired()` in lib/cookies.ts turns true and a test goes red.
Our cookies
kin_session— Keeps you signed in to the account you opened. It is httpOnly, so no script can read it, and it carries a signed token rather than anything about you. Without it there is no way to stay signed in.kin_theme— Light or dark, as you chose it with the control in the header. One of three states — the third is the absence of the cookie, meaning “follow my device”. It identifies nobody, and it is read on the server so the first frame paints the right colours.kin_locale— The language you picked. It identifies nobody and holds one of the languages the product ships.
Third parties
Cloudflare Turnstile runs the bot check on the sign-up, sign-in, account-recovery and contact pages. Cloudflare states that it sets no cookie and does not use what it sees to profile you.
It never runs on the page a rescuer opens when they scan a tag. That page makes no outside request at all, which is the one promise here that is not tradeable.
Turning things off
Your browser can block or clear all of these. Blocking the session cookie means you cannot sign in — not because we refuse, but because there is nowhere left to keep the fact that you did. Clearing the other two loses your colour and language choices and nothing else.
There is no setting on our side to switch them off, because switching off a strictly necessary cookie is switching off the thing it is necessary for.
Not stored, and worth saying
No analytics, no advertising identifier, no cross-site tracker, no fingerprinting, and no local copy of anyone's emergency page: the service worker deliberately never caches a tag's page, so a phone that scanned a stranger's helmet keeps nothing of theirs.
Contact
Questions: write to us — .