Cookies and local storage
This page lists, in full, what Taelo stores in your browser, what for, and for how long. Every entry is set by Taelo itself. There are no third-party cookies, no analytics, no cross-site tracking, and no advertising identifiers.
Why there is no banner
Every entry below is strictly necessary to run the product: it keeps you signed in, remembers your language and time zone, or stores how you set up a view. German law (§ 25 (2) no. 2 TDDDG) expressly provides that storage of this kind needs no consent. That is why we do not ask, and why there would be nothing to decline that would not break the product. Should Taelo ever set something that is not necessary, it will be listed here and asked for first.
Cookies
| Name | What it is for | Lifetime |
|---|---|---|
taelo_token | Keeps you signed in. Without it you would have to sign in again on every page. | 12 hours |
taelo_imp | Support only: the time-boxed session a Taelo staff member uses to look at your workspace at your request. Every such access is written to the audit log. | 30 minutes |
taelo_imp_name | The name of the workspace being viewed that way, so the interface can show throughout that a support session is running. | 30 minutes |
taelo_cleared | A one-shot marker set right after a session expires, so the sign-in page can say “session expired” rather than simply appearing. | 10 seconds |
taelo_login_error | A one-shot marker carrying the reason a single-sign-on attempt failed, so the sign-in page can say what went wrong in your language instead of showing a code. It is set only when such an attempt fails, and it holds nothing about you. | 60 seconds |
taelo_locale | Your language. The server has to know it before it builds the first page. | 1 year |
taelo_tz | Your time zone, so a date rendered on the server is in the zone you read it in. | 1 year |
taelo_home_overview, taelo_home_queue | Whether you collapsed the overview or the Today queue on the home page. The server needs this too before it builds the page, otherwise it jumps as it loads. | 1 year |
taelo_calendar_view | Whether the calendar page shows your week as a grid or as a list. The server needs this before it builds the page. | 1 year |
taelo_contacts_sort | How you last sorted the contact list, such as “Newest first” or “Name A to Z”. The server needs this too before it builds the list. | 1 year |
taelo_dns_asked | The domain whose DNS entries you viewed, or copied for your IT, on the setup page, so that step shows it is waiting instead of asking again. It holds the domain name and nothing else. | 90 days |
taelo_site_theme | Only on the public website, and only once you use its light/dark switch: whether you read it light or dark. The server needs this before it builds the page, or it would flash the other look. | 1 year |
taelo_booth | Only for booth staff a workspace issued a booth pass to, and read only by the booth pages under /booth (the browser sends it with every request to the app): it holds that pass, so a helper at a trade-fair stand can capture visitors without a Taelo account. It is set when the pass link is opened and holds nothing else. | Until the booth pass ends (by default at the end of the day after the fair) |
taelo_token, taelo_imp, taelo_imp_name, taelo_cleared, taelo_login_error and taelo_booth are HttpOnly: no JavaScript in the browser can read them. All cookies are set SameSite=Lax (taelo_booth even SameSite=Strict) and are additionally sent as Secure over HTTPS. None carries a Domain attribute: they apply only to the host you are on, not to other subdomains.
Local storage in your browser
Four entries live in your browser’s localStorage rather than in a cookie. The first three are view settings; they are never sent to the server and do not leave your device:
theme: light or dark appearance.sidebar-collapsed: whether the sidebar is collapsed.segments-collapsed: whether the list of saved views is collapsed.
The fourth exists only if you signed up for the reading demo on the public website: taelo_demo_reg holds the random id of that sign-up, so the demo can count your reads without asking for your address again. It is sent with each read you start, and with nothing else. Delete it and the demo asks you to sign up once more; what is stored about the sign-up itself, and for how long, is in the privacy notice.
Stored on the device for the offline capture
In a trade-fair hall there is often no network. So that a photographed business card is not lost, the page Capture a contact (and the booth pass on /booth) keeps two more things in your browser. Both exist only once you have opened one of those pages, and neither is ever sent to anyone but Taelo:
taelo_capture_queue: an IndexedDB database. It holds each photographed card that has not reached Taelo yet: the downscaled photos, what a QR code on them said, the trade fair, the time, and which user (or which booth pass) took it. The photos show a person’s contact details. An entry stays until Taelo has accepted it (then it is deleted at once) or until you delete it yourself (“Delete” next to the card). A card taken by another user of the same device is neither shown to you nor sent under your name. On/booththe same database also keeps the last details the booth pass answered (the trade fair, the pass’s label, its daily limit and the product groups, never the pass itself) so the page opens without a network; the next pass opened on this device replaces them.taelo_capture_pagesandtaelo_capture_static_…: the caches of a service worker that works only on those two pages. They hold the program files of the app and the last copy of the capture page itself, so it opens without a network. Nothing else: no other page, and no answer of the server about your contacts, captures or sign-in. The program files are replaced with every new version of Taelo.
“Reset offline mode” on the capture page removes the service worker and its caches. The same happens when you sign out and, when a session ends without signing out, as soon as the sign-in page appears. In all three cases the cards still waiting stay until they are sent or deleted. Deleting this site’s data in your browser removes everything at once, including cards that were never sent. The workspace (your-name.taelo.net) and the booth pass are two different addresses, so each keeps its own queue.
What you can do
You can delete cookies or block them for this site at any time in your browser. Deleting taelo_token signs you out; deleting the rest only loses your view settings, which are set again next time. Blocking cookies for this site entirely makes signing in impossible: the session then has nowhere to live.
How Taelo processes personal data more generally is in the privacy notice; which service providers are involved is on the sub-processors page. Questions: hello@taelo.net.