Legal & privacy
Cookies and browser storage
What Imazeo stores on your device, why it is used and which controls are available today.
Effective:
What this notice covers
This notice covers Imazeo’s public website, Customer portal and Admin portal. Cookies and localStorage are different browser technologies; both can hold information on your device. It describes the application’s browser storage and supported third-party services. Hosting and third-party sign-in pages can have their own storage practices.
The public website
Fonts and demonstration assets are served locally. The contact form does not save your inquiry in browser storage. A session-status check can tell the website whether you are signed in to the Customer portal, without returning your credentials or account details. When a reviewed production build includes Google Analytics 4, Main loads Google’s gtag scripts to measure visits and page usage. Imazeo does not add advertising or session-replay scripts in this integration.
| Cookie | Purpose and lifetime |
|---|---|
| _ga | Google Analytics client identifier used to distinguish visitors. Typical lifetime is up to two years; lifetime and exact names are controlled by Google. |
| _ga_* | Google Analytics 4 session and state cookie for the configured measurement ID. Typical lifetime is up to two years. |
Account session cookies
Signing in uses a refresh cookie on the API host. It is HttpOnly, so application JavaScript cannot read it. Deployed HTTPS environments use Secure, SameSite=Strict and the __Host- prefix, without a shared parent-domain cookie. The Customer and Admin realms use separate cookies. Access tokens stay in memory.
These are persistent cookies with a Max-Age tied to server-session expiry, not cookies that necessarily disappear when you close a browser. Refresh lifetime is configurable; the current backend default is 30 days. Portal idle sign-out can end access sooner. Revoking access prevents authentication even if an expired or revoked cookie remains on a device; signing out clears the current realm’s cookie.
| Cookie | Purpose and lifetime |
|---|---|
| __Host-imazeo_customer | Customer session restoration on the API host. Expires with the server session; cleared on sign-out. |
| __Host-imazeo_admin | Separate administrative session restoration on the API host. Expires with the server session; cleared on sign-out. |
| imazeo_customer / imazeo_admin | Names used in local/development HTTP environments instead of the HTTPS-only prefix. |
Browser preferences and session coordination
Customer browser storage keeps sidebar state, the selected project, recent project identifiers/names and dismissed capacity alerts. Both portals retain a non-secret session reference and last-activity timestamp to coordinate idle sign-out. These values do not grant account access, but recent-project information can identify your work on a shared device. There is no application expiry for all preference entries; they can remain until overwritten or you clear site data.
API keys, passwords and access tokens are not stored in localStorage or sessionStorage. Clearing browser preferences does not erase projects, uploaded files or other server records.
Optional third-party services
When enabled, Cloudflare Turnstile loads after a validated public contact or Customer authentication submission. It can process device, browser and interaction information, and can use its own storage. Once loaded, its script may remain active while that page is open. This notice does not classify every Cloudflare operation as strictly necessary or treat submitting a form as blanket consent to unrelated processing.
Google Analytics 4 loads on the public Main site when the production build includes a measurement ID. Google may set analytics cookies and receive page-usage signals under Google’s terms. Imazeo uses the default measurement configuration without advertising remarketing features in this integration.
Google and GitHub sign-in are only used when enabled and you choose the provider. Their sign-in pages may use their own cookies and privacy terms. The public contact page offers email as an alternative to submitting a CAPTCHA-protected inquiry; email does not replace verification required for an account sign-in.
Your controls
You can sign out, revoke sessions and clear cookies or site data using your browser. Blocking the API session cookie prevents session restoration and may require signing in again. Clearing localStorage resets preferences and idle-coordination data. Blocking or clearing Google Analytics cookies limits or resets that measurement for your browser. On shared devices, sign out and clear site data before handing the browser to someone else.
There is currently no in-product analytics-consent banner or saved consent preference. This notice does not replace consent where applicable law requires it for a particular use of browser storage. Contact contact@imazeo.com about the configured services or your privacy choices.
Questions and updates
Contact contact@imazeo.com with “Privacy request” in the subject for questions about browser storage. Read the Privacy Notice for server-side data handling and retention. This notice takes effect on the date shown above. Changes to the inventory will be reflected here with a revised date.