Cookie Policy

Last updated: 8 September 2026

The OZ Project Portal uses two cookies. Both exist only to sign you in and keep you signed in. There are no analytics, advertising or tracking cookies, and nothing on the Portal reports your visit to anyone else — which is why you are not asked to accept anything.

Contents

A cookie is a small text file that a website asks your browser to store and send back on later visits. It is how a site recognises that two page requests came from the same person. Without one, you would have to enter your password on every single screen.

2. The cookies we use

Name	Purpose	Lasts	Type
`PHPSESSID`	Identifies your signed-in session so the Portal knows who you are as you move between screens. It is also set when you open a password-protected shared link, so that you do not have to retype the password on every page of that link. It holds only a random identifier — no personal data is stored in the cookie itself.	Until you close your browser, sign out, or are inactive for 30 minutes	Strictly necessary
`rm_token`	Set only if you tick "Remember me" when signing in. Lets you return without entering your password again.	Until it expires or you sign out	Set by your choice

How both are protected

Secure — sent only over an encrypted HTTPS connection, never in the clear.
HttpOnly — unreadable by scripts running in the page, which limits the damage a cross-site scripting flaw could do.
SameSite — PHPSESSID uses Lax and rm_token uses the stricter Strict, so they are not sent along with requests triggered by other websites.

The "remember me" token is not simply stored and reused. Only a hash of it is kept on the server, it is replaced with a fresh one every time it is used, and if an old token is presented again after it has been replaced, the Portal treats that as a sign the token was copied and invalidates every remembered sign-in for that account. Signing out deletes it outright.

3. Other storage the Portal uses

Your browser also keeps a small amount of information for the Portal outside of cookies. It is never transmitted to us, and it is cleared when you close the tab.

What	Purpose
`sessionStorage` — which project view you had open	Returns you to the Project Board or the Folder System, whichever you were last using, instead of resetting every time you open a project.

4. What we do not use

To be explicit, the Portal contains none of the following:

Analytics or statistics cookies — no Google Analytics or equivalent.
Advertising, retargeting or social media cookies.
Tracking pixels, web beacons or fingerprinting.
Content delivery networks. Fonts, icons and libraries are served from our own server, so loading a page does not tell any third party that you visited.
Any cookie set by a company other than us.

This is enforced technically as well as by policy: the Portal's Content Security Policy prevents pages from loading resources from anywhere other than our own server.

Under the Privacy and Electronic Communications Regulations 2003, consent is required before storing information on your device — except where the storage is strictly necessary to provide a service you have asked for.

Signing in to a private portal is exactly that case, and so is entering the password on a protected shared link. PHPSESSID is the mechanism that delivers the service you requested, so it falls within the exemption. rm_token is set only when you tick the box yourself, which is your consent — untick it, or sign out, and it is not used.

A banner asking you to accept cookies you cannot refuse would be misleading. If we ever introduce a cookie that is not strictly necessary, we will ask for your consent first and update this policy.

6. Managing cookies

You are always in control:

To clear the "remember me" cookie — sign out. That deletes it from your browser and cancels it on the server.
To clear everything — delete cookies for this site in your browser settings.
To block them — you can, but the Portal will not be able to sign you in. Blocking the session cookie means every page will return you to the login screen.

Guidance for individual browsers is available from the ICO.

7. More information

How we handle personal data generally is set out in our Privacy Notice, which also explains your rights and how to complain to the Information Commissioner's Office.

Questions about this policy: {{DP_EMAIL}}.