Cookie Policy

The server uses user_session for an authenticated user session, admin_session for an authenticated admin session, and csrf_token to help protect state-changing requests made with cookie authentication. The session cookies are HttpOnly, scoped to /api, and protected with SameSite; they are Secure in production. user_session can persist for up to 30 days, while admin_session can persist for up to 7 days. These cookies are essential for the related sign-in and security flows.

When you change the desktop sidebar between expanded and collapsed states, the app stores sidebar_state as a first-party preference cookie. It is scoped to the site and kept for up to 7 days. It is not used for authentication, analytics, advertising, or cross-site tracking.

The app also uses browser storage, which is separate from cookies. localStorage can hold language (app_lang), timezone (app_timezone), theme and display settings, non-sensitive session-presence flags, the remember-me preference, drafts, journal/sync data, and other feature preferences. sessionStorage can hold the temporary analytics session identifier (__niko_session__), session-scoped user or admin token backups, and short-lived sign-in or verification state. These values are not cookies and are not sent automatically as Cookie headers.

NIKO Journal uses a first-party analytics client rather than a third-party analytics SDK or advertising tracker. It sends an allowlisted set of product and reliability events to the NIKO Journal API and uses the sessionStorage identifier __niko_session__ to group events during a browser tab session. This identifier is not a cookie, and the app does not use advertising cookies or sell analytics data.

Use your browser's site settings to inspect, block, or delete cookies and browser storage. Removing user_session or admin_session signs the related account out; removing csrf_token can prevent cookie-authenticated state changes until it is issued again. Clearing localStorage may reset language, timezone, display settings, drafts, cached or synchronized data, and other preferences. Clearing sessionStorage ends tab-scoped sign-in, verification, and analytics state. The cookie-consent choice is stored in localStorage as __niko_cookie_consent__; it is not itself a cookie.