Cookies and browser storage

1. Overview

This notice covers the DPPLogic service at https://pilot.dpplogic.com. The dpplogic.com website has its own notice at https://dpplogic.com/cookies/.

The service does not use analytics, advertising or social media cookies, and it loads no third-party scripts: its Content Security Policy allows scripts only from the service itself.

2. Essential cookies

__Host-dpp: keeps you signed in. Set when you sign in. Contains a random session token; DPPLogic stores only a hash of it. Secure, HttpOnly, SameSite=Lax, whole site. Expires after 12 hours at most; the session also ends after 30 minutes of inactivity or when you sign out.

dpp_workos_tx: protects the sign-in process. Set when you start signing in or creating an account. Contains a one-time verification value that links the sign-in page's response to your browser. Secure, HttpOnly, SameSite=Lax, limited to the sign-in path (/api/workos). Expires after 10 minutes and is cleared when sign-in completes.

dpp_checkout: lets your browser apply a paid purchase to an organisation. Set when you start a paid checkout. Contains a random claim code. Secure, HttpOnly, SameSite=Lax, limited to the billing path (/api/billing). Expires after 24 hours and is cleared when the purchase is applied.

These cookies are strictly necessary to provide the service you ask for, so they are set without a consent banner.

3. Browser storage (localStorage)

These items are stored only in your browser. They are not sent to DPPLogic automatically, and they stay until you remove them or clear your browser storage.

dpplogic.ui.locale: the workspace language you chose.

dpplogic.workflow.views.v1 (followed by organisation and account identifiers): saved views, meaning up to 10 named filter settings you create for an organisation. They are available only in this browser.

dpp-pending-checkout-intent: the reference of a completed checkout that has not yet been applied to an organisation. Removed when it is applied.

4. Browser session storage (sessionStorage)

dpp-response-link: used only on the secure supplier response page. It keeps the secure response link for the open browser tab, so that reloading the page keeps working after the link is removed from the address bar. The page sends it to DPPLogic only to open and answer the request, and it is removed when the tab is closed or when the link is no longer available.

5. Sign-in and payment pages

Sign-in and account creation happen on pages hosted by WorkOS, and payment happens on Stripe's checkout pages. Those providers set their own cookies on their own domains to run and secure those pages, under their own policies: https://workos.com/legal/privacy and https://stripe.com/privacy .

DPPLogic does not control those cookies and does not receive them.

6. Managing cookies

You can delete cookies and browser storage in your browser settings. If you block or delete the essential cookies, you will be signed out and will not be able to sign in or complete a checkout.

7. Changes

If the service starts using any other cookie or browser storage, this notice will be updated first. Questions: support@dpplogic.com.