Cookie Policy

This page describes the cookies used for login and session security in the IT Folder application, and the cookies on our marketing pages.

Last updated: September 27, 2026

Scope

This Cookie Policy covers cookies used by the IT Folder web application (e.g., app.itfolder.com), which uses only sign-in and security cookies, and by our public marketing pages, which use Google Analytics cookies only after you consent through the cookie banner (see Third‑Party Cookies and Cookie Consent below). We do not set advertising cookies.

What Are Cookies?

Cookies are small text files placed on your device by your browser at the request of a website. They are widely used to keep you signed in, enable site functionality, and protect your account.

How We Use Cookies (Login Only)

Essential Authentication & Security Cookies

These cookies are strictly necessary to sign you in, keep you signed in securely, and protect your account from cross‑site request forgery (CSRF). Without them, you cannot log in or use the application.

Note: We do not use CSRF tokens on the /login,Passkey, SSO, and MFA verification endpoints. Those endpoints are unauthenticated or use a one‑time flow. After you successfully authenticate, we set a CSRF cookie for state‑changing requests inside the app.

Cookies We Set

Cookie Purpose Type Duration Attributes
__Host-access_token Opaque token that maps to your JWT session. Keeps you signed in during an active session. Automatically refreshed when you're actively using the application. Session (essential) 15 minutes (renewed during activity) Secure; HttpOnly; SameSite=Lax; Path=/; HTTPS only.
__Host-refresh_token Signed JWT used to automatically refresh your access token. Enables "keep me signed in" functionality across browser restarts. Persistent (essential) 7 days (30 days with 'remember me') Secure; HttpOnly; SameSite=Lax; Path=/; HTTPS only.
csrf_token Cross-site request forgery protection token. Set after successful authentication. Used with matching X-CSRF-Token header for state-changing requests. Session (essential) 30 days; server-side session checks still apply Secure; SameSite=Lax; HttpOnly=false (readable by JavaScript); Path=/; HTTPS only.
__stripe_mid Set by Stripe.js on the billing page only, for payment fraud prevention. Controlled by Stripe (see Stripe's cookie policy). Persistent (essential, third-party script) 1 year Cookie attributes are controlled by Stripe; set when the billing page loads Stripe.js.
__stripe_sid Set by Stripe.js on the billing page only, for payment fraud prevention during a checkout session. Controlled by Stripe. Session (essential, third-party script) 30 minutes Cookie attributes are controlled by Stripe; set when the billing page loads Stripe.js.

Session behavior:

  • Active use: Access tokens are renewed while you're using the app
  • Session limits: Configurable by your organization; the default is 10 concurrent sessions per user
  • Inactivity: Sessions expire based on your organization's configured idle timeout, or 30 days for "remember me" sessions
  • Device tracking: Basic device information (browser, platform, and full session IP address) stored for security monitoring

Device Information Collection

For security and session management, we collect minimal device information including:

  • Browser type (e.g., "Chrome", "Firefox") - extracted from detailed browser data
  • Platform (e.g., "macOS", "Windows")
  • IP address - stored in full for session validation, security and audit logs, authorized log views, abuse detection, and incident investigation
  • Timezone and language for user experience
  • Basic mobile/desktop detection

We do not generate persistent device fingerprints for tracking. Browser and user-agent information may include version numbers. Device information supports session security, detection of suspicious login attempts, and the user experience.

For network and ISP enrichment, the queried IP address is sent over HTTPS to ipapi.co to obtain ISP/organization, ASN, country, and approximate network-location information. This server-side lookup is separate from cookies. See our Privacy Policy and sub-processor list.

Session Timeout

Your session will automatically expire based on your organization's configured idle timeout, or after 30 days of inactivity if you selected "remember me" during login. The access token refreshes automatically while you're actively using the application, but stops refreshing during periods of inactivity.

Data Retention

Session data and device information are automatically deleted when:

  • You explicitly log out
  • Your session expires due to inactivity (based on organization settings or 30 days for "remember me")
  • Your refresh token expires (7 days, or 30 days for "remember me")

Security and audit records containing full IP addresses may be retained separately from sessions for abuse detection, auditing, and incident investigation. Central application logs have a 90-day retention policy; this is not a universal retention limit for every audit record. Session records expire with the server-side session. Standard sessions use the organization's configured idle timeout (7 days by default); "remember me" sessions use a 30-day inactivity window. Active sessions can be renewed, so these windows are not fixed limits from the first sign-in.

Third‑Party Cookies

We use Google Analytics on our public marketing pages to understand site usage and improve content. These analytics cookies are not required to sign in and are not used on the login or MFA endpoints. Typical GA cookies include _ga and _ga_* (up to ~2 years), and _gid (~24 hours). We use Google Analytics 4, which does not log or store IP addresses.

Some marketing pages include embedded YouTube videos. When such a page loads, your browser connects to youtube-nocookie.com (Google LLC) to display the player, and Google receives your IP address and browser information; if you play the video, it also receives your playback interactions and may set cookies or use local storage in its player under Google's privacy policy. We use YouTube's privacy‑enhanced mode, which does not use views to personalize advertising.

Our marketing pages display a cookie consent banner that allows you to accept or decline non-essential cookies (such as Google Analytics) before they are loaded. Essential authentication cookies used by the application do not require consent under the ePrivacy Directive, as they are strictly necessary for the Service to function.

In jurisdictions that require prior consent for analytics cookies (including the EEA and UK under the ePrivacy Directive), Google Analytics scripts are not loaded until you provide affirmative consent through the cookie banner. You can change your cookie preferences at any time by clicking the cookie settings link in the footer of our marketing pages.

Your choice is remembered in a first‑party cookie, itf_cookie_consent, which holds all or essential for 365 days. It is set on .itfolder.com so one choice covers both the marketing site and the app, and it contains no personal data. Choosing Cookie Settings clears it and shows the banner again.

Your light or dark theme choice is saved in your browser's local storage as itf-theme (light or dark) so every page uses it. It stays on your device, is never sent to us, and is not a cookie. Clearing your browser's site data removes it.

Global Privacy Control

If your browser sends the Global Privacy Control (GPC) signal, we treat it as "Essential Only": Google Analytics is never loaded, the banner does not ask, and any earlier "Accept All" choice on that browser is overridden while the signal is on.

Your Choices

Because these cookies are strictly necessary for authentication and security, blocking them in your browser will prevent you from logging in. You may delete cookies at any time via your browser settings; you will be asked to sign in again.

Security

Authentication cookies are issued over HTTPS with Secure and HttpOnly flags and a restrictive SameSite policy. CSRF protection applies after authentication and uses a separate cookie paired with an X‑CSRF‑Token header. The /login, Passkey, SSO, and MFA verification endpoints do not require CSRF because they are unauthenticated or use a one‑time, short‑lived MFA flow. Access cookies are opaque and refresh cookies contain signed JWTs; both are validated server-side, and session identifiers are rotated as appropriate (e.g., after MFA success).

Contact Us

Questions about this Cookie Policy? Contact support@itfolder.com.