Cookie Policy

1. What Are Cookies

Cookies are small text files stored on your computer, tablet, or mobile device when you visit a website.

Cookies allow a website to recognize your device and remember certain information about your visit, such as authentication status, security checks, or preferences.

Cookies are commonly used to enable core website functionality and improve security.

2. Why Machestra Uses Cookies

Machestra uses cookies for two purposes:

• Authentication and security (essential): authenticate logged-in users, maintain secure sessions, protect against automated attacks, ensure only authorized users access company data.
• Product analytics (non-essential): understand how visitors use our website so we can identify usability issues and improve the product. We use Microsoft Clarity for this. See Section 5 for full details.

Authentication and security cookies are essential for the service to function. Analytics cookies are not essential, and you can opt out by emailing [email protected].

Machestra does not use cookies for advertising or marketing.

3. Cookie Inventory

The following table lists all cookies currently used by Machestra.

The Microsoft Clarity cookies are non-essential. The remaining cookies are essential for authentication and security.

4. Essential Cookies Explained

The authentication and security cookies below are strictly necessary for Machestra to operate. The Microsoft Clarity cookies described in Section 5 are non-essential and can be opted out.

Access Token Cookie

The access_token cookie authenticates each request made to the Machestra API.

This cookie contains a signed JSON Web Token (JWT). Its payload is a session identifier and nothing else.

The token carries no personal information: not your name, your email address, your role, or the company you belong to, and never a password. All of that is read from your session on our servers on each request, which is what lets a change to your access, such as a new role or being signed out, take effect straight away rather than waiting for the token to expire.

It expires after 5 minutes, reducing the risk of session theft.

Refresh Token Cookie

The refresh_token cookie allows the application to issue new access tokens without forcing users to log in repeatedly.

This cookie:

• Maintains a secure authenticated session
• Improves usability while maintaining strong security controls

Expiration:

• 7 days (standard session)
• 30 days if the user selects "Remember Me" at login

__cf_bm (Cloudflare)

This cookie is set by Cloudflare's bot management system.

It helps identify automated traffic and prevents malicious bots from accessing the platform. This protects the service from abuse and denial-of-service attacks.

Expiration: 30 minutes

cf_clearance (Cloudflare)

This cookie is set when a visitor successfully passes a Cloudflare security challenge.

It confirms that the user has been verified as legitimate traffic.

Expiration: up to 1 year, depending on Cloudflare configuration.

5. Third-Party Cookies

Google OAuth Authentication

If a user chooses to sign in using Google Sign-In, Google may set cookies on the domains accounts.google.com and google.com.

These cookies facilitate the OAuth 2.0 authentication process.

Important notes:

• These cookies are controlled by Google, not Machestra
• They are only present during the Google login flow
• They are governed by Google's privacy policies

If you do not wish to interact with Google cookies, you can log in using email and password instead.

Microsoft Clarity (Behavioral Analytics)

We use Microsoft Clarity to understand how visitors interact with our website. Clarity captures session recordings, heatmaps, click and scroll behavior, and basic device information so we can identify usability issues and improve the product.

Clarity sets first-party cookies (_clck, _clsk) on our domain to identify the user and stitch page views into recordings, and a third-party cookie (CLID) on .clarity.ms for first-time visitor detection.

Clarity normally also pings c.bing.com to sync the visitor with Microsoft's cross-site advertising identity graph (used for Microsoft Advertising). We block this request via our Content Security Policy. The Microsoft advertising-identity sync does not happen on Machestra.

Important notes:

• Form inputs are masked by default; we do not capture what you type into form fields
• Clarity is GDPR and CCPA compliant
• Behavioral data captured by Clarity is sent to Microsoft servers and handled under the Microsoft Privacy Statement
• To opt out of recordings, email [email protected]

6. Other Storage Technologies

Service Worker (Push Notifications)

Machestra may register a service worker (sw-push.js) when a user opts into push notifications.

This service worker is used solely to:

• Receive push notifications
• Display system alerts (such as job updates or machine status changes)

The service worker does not track users or store personal data.

Browser Storage

Machestra follows strict storage practices:

• Authentication tokens are never stored in localStorage or sessionStorage
• Tokens are stored only in HTTP-only secure cookies, which cannot be accessed by JavaScript

This protects users from cross-site scripting (XSS) attacks.

Minimal sessionStorage may occasionally be used to temporarily store UI state (for example, unsaved form data). No personal information is stored there.

8. How to Manage Cookies

Most browsers allow you to control or delete cookies through browser settings.

However, because Machestra relies on cookies for authentication and security, disabling cookies will prevent the platform from functioning.

Instructions for common browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and Other Site Data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari: Settings → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and Site Permissions → Manage Cookies
• Mobile Browsers: Consult your mobile browser's help documentation for cookie settings

9. Impact of Disabling Cookies

Machestra requires cookies to function. If cookies are disabled:

• Users cannot log in
• Authentication cannot be maintained
• API requests cannot be verified
• The platform will not operate correctly

There is no cookie-free version of the service, because authentication cookies are required to protect company data.

10. Cookie Consent

Under the EU ePrivacy Directive, cookies that are strictly necessary to provide a service requested by the user do not require consent. Authentication and security cookies on Machestra fall into this category.

The Microsoft Clarity analytics cookies described in Section 5 are not strictly necessary. Microsoft Clarity enforces consent signal requirements for visitors in the European Economic Area (EEA), United Kingdom, and Switzerland: in these regions, Clarity will not set its cookies or capture recordings unless a valid consent signal is provided. Outside these regions, Clarity cookies are set by default.

To opt out of Clarity recordings, email [email protected].

11. Updates to This Cookie Policy

We may update this Cookie Policy from time to time. If changes are significant, we will notify users through:

• Email notification
• In-app notification
• Updates to the Effective Date at the top of this page

Continued use of the service after updates indicates acceptance of the revised policy.

12. Contact

If you have questions about this Cookie Policy, please contact us.

Email: [email protected]