Cookies

No analytics cookies

Typoza sets no cookie to count, track or retarget anyone. Those that exist do two things and nothing else: keep a session open — an account's, or that of a reader who confirmed their address to react or comment — and secure a sign-in in progress, without which the service asked for would not work; and remember a display choice you have just made yourself, such as the shape of the menu or the light or dark ground you read on.

That is what explains the absence of a consent banner. The law requires one only for what goes beyond the service requested, and it expressly exempts these two categories: what makes the site work, and what remembers a display preference you expressed. Each cookie in the list below says which of the two it relies on. We set nothing outside them. Were that to change, the banner would appear, and this page would say so before it did.

One thing on this site asks for your agreement, and it does not go through a banner: notifications on your devices, which you switch on yourself and whose exact effect a section below sets out. Until you have asked for them, they do not exist.

On a workspace's public site: none, unless asked for

A site published with Typoza sets no cookie for a reader who comes to read and touches nothing. Not one, not even ours: a workspace's traffic measurement relies on a script that counts page views without writing anything to the browser and without keeping an IP address.

Three things can set one, and each takes a deliberate act. The first is the sun and the moon at the top of every page, which let you read on a light or a dark ground. That choice is remembered from page to page and from workspace to workspace — otherwise it would have to be made again at every visit, which would be no choice at all. The cookie that carries it holds a single word, says nothing about who you are, and appears only after the click.

The second is “Aa”, right beside them: the size of the text, and a reading font drawn for low vision or for dyslexia. A second cookie remembers them, on the same terms: a size and a font name, set at the first choice — or when you close the short note that points to these settings — and never on arrival.

The third is reacting or commenting under a post. The first time, the site asks for your email address and sends you a link; clicking it publishes what you wrote and leaves a cookie on that site alone, so that your next reaction or comment goes through without a new link. It holds no address and no name, is worthless on any other workspace's site, and “Not you?” under the form removes it.

The other cookies listed below are for you who write, never for those who read you: they appear on the Typoza site and in the application — and, for the Workbench, on your own site, when you open it from your dashboard; the bar then says so. One exception exists and comes from you: content you embed in a post — a video, a public message — may set the cookies of the service it came from. The privacy page sets this out in detail.

Nor does a workspace's site write anything else into a reader's browser, except once more after a gesture: answering “later” to a newsletter invitation, or subscribing to it, leaves a date there, so that the invitation does not come back on every page. The section on local storage describes it.

The cookies set

• typoza.session_token

  Purpose

  Keeps a session open from one page to the next, once you are signed in

  Lifetime

  7 days, extended on each use after 24 hours

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.state

  Purpose

  Ties the return of a GitHub sign-in to the request that started it, and refuses a forged return

  Lifetime

  The length of the sign-in, a few minutes

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.pkce_code_verifier

  Purpose

  Proves, on the way back from GitHub, that this very browser asked to sign in

  Lifetime

  The length of the sign-in, a few minutes

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.two_factor

  Purpose

  Holds a sign-in in suspense between the accepted password and the six-digit code — meanwhile there is no session

  Lifetime

  10 minutes

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.trust_device

  Purpose

  Remembers that a device has already passed the second step, if and only if the box was ticked — it is not by default

  Lifetime

  30 days

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.challenge

  Purpose

  Ties the signature a passkey produces to the challenge the server has just issued, and refuses a replayed signature

  Lifetime

  5 minutes

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.sidebar

  Purpose

  Remembers the shape of the application's side menu: reduced to its icons or spread out, and which groups were opened or closed. It holds nothing but that setting and group names, and only appears after a first click — someone who never touches it receives none

  Lifetime

  1 year

  Exempt as

  A display preference you expressed yourself

  Where

  The application

  Set by

  Typoza

• typoza.lists

  Purpose

  Remembers how the dashboard's lists are shown — as rows or as a grid — and the last filters used on each list, per workspace, so the list you come back to is the one you left. It holds list names, workspace identifiers and filter values — the words of a search among them — and only appears after a first click on a filter or on the display switch — someone who never touches them receives none

  Lifetime

  1 year

  Exempt as

  A display preference you expressed yourself

  Where

  The application

  Set by

  Typoza

• typoza.workbench

  Purpose

  Keeps open, on a workspace's site, the management bar one of its members has just opened from their dashboard. It carries no right: it points to a session, and the role is checked again on every page. A reader who is not a member never receives one — and each time it is set, the bar says so

  Lifetime

  2 hours, or until “Leave the Workbench” is clicked

  Exempt as

  Strictly necessary to the service you asked for

  Where

  A workspace's public site

  Set by

  Typoza

• typoza.scheme

  Purpose

  Remembers the light or dark ground asked for with the sun, the moon or automatic, and applies it everywhere on Typoza — dashboard, marketing site and workspace sites. It holds one word out of three, says nothing about who you are, and is set only after a click: nobody receives one without asking

  Lifetime

  1 year, or until the next change

  Exempt as

  A display preference you expressed yourself

  Where

  The application · The Typoza site · A workspace's public site

  Set by

  Typoza

• typoza.reader

  Purpose

  Remembers, on one workspace's site, that you confirmed your email address to react or comment under its posts, so you are not asked again each time. It is set only when you click the link you received after reacting or commenting — a reader who does neither never receives one. It holds no address and no name, only a signed reference that is worthless on any other site, and “Not you?” under the form removes it

  Lifetime

  6 months, or until “Not you?” is clicked

  Exempt as

  Strictly necessary to the service you asked for

  Where

  A workspace's public site

  Set by

  Typoza

• typoza.reading

  Purpose

  Remembers, on the workspace sites you read, the text size and the reading font you chose behind “Aa”. It holds a size and a font name, says nothing about who you are, and is set only after a choice — or when you close the note that points to these settings: nobody receives one without asking

  Lifetime

  1 year, or until the next change

  Exempt as

  A display preference you expressed yourself

  Where

  A workspace's public site

  Set by

  Typoza

• typoza.staff

  Purpose

  Keeps a Typoza team member's session open, on admin.typoza.com only. It holds a single token, is set only after the password and the passkey, and stops working after fifteen minutes without activity or eight hours

  Lifetime

  Until the browser closes; fifteen minutes without activity, or eight hours, make it useless

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

• typoza.staff-step

  Purpose

  Holds, on admin.typoza.com only, a team member's sign-in step between the password and the passkey. It carries a single-use token that opens nothing but the next step

  Lifetime

  Thirty minutes at most; removed as soon as the step succeeds

  Exempt as

  Strictly necessary to the service you asked for

  Where

  The application

  Set by

  Typoza

Local storage

The law treats cookies and everything else written into your browser the same way. Here, then, is the rest. None of it ever leaves for a server: the draft kept when the network is missing, the address tried on the home page, the application's files, and the “later” given to a newsletter invitation. None holds a workspace page, and none recognises anyone.

• typoza-offline (IndexedDB)

  Purpose

  Keeps on your device the post you are writing, for as long as it could not be saved — a network cut, an underground train, a tab the phone closes to recover memory. It holds the text of that one draft and the time of the last keystroke. It is erased as soon as the save goes through, and you can delete it yourself by clearing the site's data

  Exempt as

  Strictly necessary to the service you asked for

• typoza:pending-workspace

  Purpose

  Remembers the address you tried on the home page — “my-blog”, say — while you create your account, so that the next form already carries it and you do not have to type it again. It holds that one word and the date you wrote it, nothing else. It goes to no server, is read by your browser only, erases itself after twenty-four hours, and as soon as the workspace is created

  Exempt as

  Strictly necessary to the service you asked for

• typoza-shell-v1 (Cache Storage)

  Purpose

  Keeps the application's files — scripts, style sheets, the page shown when the network is missing — so that it opens quickly and works installed on a home screen. No workspace page, no post and no account data go in: only files that are the same for everyone

  Exempt as

  Strictly necessary to the service you asked for

• typoza:newsletter:snooze:*

  Purpose

  Remembers that you answered “later” to a workspace's newsletter invitation, or that you have just subscribed, so that it does not come back on every page. One key per workspace: saying “later” to one does not stop you subscribing to another. It holds a single date, until which the invitation stays quiet — the delay the workspace chose, one year at most, or ten years once you have subscribed — goes to no server and recognises nobody

  Exempt as

  A display preference you expressed yourself

• typoza:favicon:seen

  Purpose

  Remembers the newest post you saw on a workspace's site, and when you last left one of its pages. On your next visit, the tab icon shows how many posts came out since then. It holds these two dates and that time, is written when you leave a page you looked at, goes to no server and recognises nobody. Clearing this site's data resets the count

  Exempt as

  A display preference you expressed yourself

The application's files are kept by a small program your browser keeps for Typoza — a service worker. It installs itself on your first visit to the application, without asking, because it collects nothing: all it does is serve already-public files when the network is missing. Clearing the site's data removes it, and it comes back on the next visit.

If you switch on notifications

The small program the previous section describes — a service worker — also knows how to receive notifications. Switching them on for a device then stores a subscription there: an address to write to, and two keys used to encrypt what we send you. It is neither a cookie nor local storage, so you will not find it in the lists above, but the law treats it the same way and this page must therefore name it.

Two differences from the rest of this page, and they point the same way. The subscription exists only if you asked for it, by a click and then a permission granted to your browser — it is the only place in Typoza where explicit consent is required. And, unlike the others, it is indeed transmitted to our server: without it we would have no way to write to you.

It is removed from your notification settings, or by withdrawing the permission in your browser. The service worker itself stays: it serves the application when the network is missing, and observes none of your visits — it sends us nothing, ever, and keeps only the files listed above.

Deleting them

Every browser allows you to erase a site's cookies and refuse future ones, from its settings. Deleting Typoza's will sign you out, close the Workbench, put the application's menu back in its original shape, forget your lists' display and filters, your light or dark ground, your text size and your reading font, and make a workspace's site ask you to confirm your address again before your next reaction or comment. That is all that will happen.

The list above is checked automatically: a test opens a browser, signs in, collects what was actually set, and fails if a name is missing from this page. What you read is therefore what you will find. The companies involved elsewhere are named on Subprocessors.