Légal
DrAxis — Cookie & Local Storage Policy
How DrAxis uses cookies, local storage, and similar technologies on its web properties.
DrAxis — Cookie & Local Storage Policy
Status: DRAFT v1 — for internal team review. Not legal advice.
Must be reviewed by qualified legal counsel before publication.
Last updated: 2026-08-23
Document control
| Field | Value |
|---|---|
| Document owner | DrAxis legal/engineering |
| Version | 0.1 (DRAFT) |
| Effective date | [to be set at publication] |
| Review cycle | Annual, or upon material change in tracking |
| Languages (target) | English, French, Arabic |
| Public URL | https://draxis.app/legal/cookie-policy |
1. Purpose
This Cookie & Local Storage Policy ("Policy") explains how DrAxis uses cookies, local storage, and similar technologies on its web properties, in compliance with:
- ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) — prior consent required for non-essential storage.
- GDPR (Reg. (EU) 2016/679) — lawful basis for processing.
- Tunisian DPA (Law 2004-63) — proportionality and consent.
- KSA PDPL (Royal Decree M/19) — consent and transparency.
- UAE PDPL (Federal Decree-Law n° 45/2022) — consent.
2. Scope
This Policy applies to:
https://app.draxis.app(web build of the mobile app, if published).https://admin.draxis.app(admin web application).https://draxis.app(landing page, privacy policy, terms).
It does not apply to the native mobile app, which uses Capacitor Preferences (a native key-value store) rather than browser cookies. Native storage is covered in the Privacy Policy.
3. Technologies used
| Technology | Description |
|---|---|
| Cookies | Small text files stored in the browser |
| Local Storage | HTML5 localStorage key-value pairs |
| Session Storage | HTML5 sessionStorage (cleared on tab close) |
| IndexedDB | Browser-side database (used by Firebase Auth for token persistence) |
For simplicity, all are referred to as "storage" below.
4. Categories of storage
4.1 Strictly necessary (no consent required)
| Item | Purpose | Storage type | Retention |
|---|---|---|---|
| Firebase Auth ID token | Keeps the user signed in | IndexedDB / Local Storage | 1 hour (refreshed automatically) |
| Firebase Auth refresh token | Allows silent token refresh | IndexedDB / Local Storage | Until sign-out |
| App Check token | Anti-abuse attestation | Local Storage | 1 hour (refreshed) |
| reCAPTCHA session token | Bot prevention during sign-in | Cookie / Local Storage | 30 minutes |
| CSRF token (if used) | Form protection | Cookie | Session |
These are required for the Service to function. Without them, authentication and anti-abuse would not work. Consent is not required under the ePrivacy Directive Art. 5(3) exception.
4.2 Functional (consent required)
| Item | Purpose | Storage type | Retention |
|---|---|---|---|
| UI preferences (theme, language) | Remember user's choices | Local Storage | Until cleared |
These are optional. Consent is obtained via a banner on first visit.
4.3 Analytics (consent required — currently none)
DrAxis does not currently use any analytics or tracking cookies. If/when analytics are introduced (e.g., PostHog, Mixpanel, GA4), this Policy will be updated and prior consent obtained via a consent management platform.
4.4 Marketing/advertising (none)
DrAxis does not use marketing or advertising cookies, and does not share data with advertising networks.
5. Consent mechanism
5.1 Banner
On first visit to any web property, a consent banner is displayed:
- Accept all — enables functional + analytics storage.
- Reject all — disables functional + analytics storage (strictly necessary storage remains).
- Manage preferences — granular toggles per category.
The choice is stored in a strictly-necessary cookie (draxis_consent) for 12 months.
5.2 No dark patterns
The banner presents "Accept" and "Reject" with equal prominence. No pre-ticked boxes. No "continue without accepting" hidden behind multiple clicks.
5.3 Withdrawal of consent
Users can withdraw consent at any time via the "Cookie preferences" link in the footer, which re-displays the banner.
6. Third-party storage
| Provider | Purpose | Consent | Privacy policy |
|---|---|---|---|
| Google Firebase | Authentication, App Check | Strictly necessary | https://firebase.google.com/support/privacy |
| Google reCAPTCHA | Bot prevention | Strictly necessary | https://policies.google.com/privacy |
No other third-party storage is used.
7. Managing storage in the browser
Users can control storage via browser settings:
- Chrome: Settings → Privacy and security → Cookies and other site data.
- Firefox: Settings → Privacy & Security → Cookies and Site Data.
- Safari: Preferences → Privacy → Manage Website Data.
- Edge: Settings → Cookies and site permissions.
Clearing storage will sign the user out and reset preferences.
8. Do Not Track (DNT)
We do not currently respond to DNT signals because we do not use tracking cookies. If we introduce analytics, we will respect DNT by default.
9. Changes to this policy
We may update this Policy. Material changes will be notified via the consent banner on next visit. Version history at https://draxis.app/legal/cookie-policy/history.
10. Contact
- Privacy / DPO:
dpo@draxis.app - Legal:
legal@draxis.app