Cookie Policy

Overview

Cookies and similar browser storage can be used for sessions, security, display preferences and optional features. This policy must reflect verified browser behaviour; it must not claim a tracking cookie exists or does not exist without testing the deployed site.

Currently identifiable functional storage

The Express session configuration uses an archforge.sid HTTP-only session cookie with a configured maximum lifetime of seven days, SameSite=Lax and Secure where HTTPS is configured. Sessions support authentication and CSRF protection. Additional cookies, localStorage, service workers and browser-push subscriptions must be inventoried in a browser audit: **Our platform maintains an inventory of cookies and browser storage technologies, including cookies, local storage, and session storage.

The inventory identifies the storage name, provider, purpose, category, and retention period of each item.

Essential cookies and storage technologies may be used for authentication, security, session management, and core platform functionality.

Non-essential cookies and storage technologies are only used with user consent where required by applicable law.

Third-party services, including SumUp for donation payments, may use their own cookies and storage technologies in accordance with their privacy and cookie policies.

Our cookie and storage inventory is reviewed and updated when changes are made to the platform or its integrated services.**. Actual expiration can differ from settings if sessions are revoked or server-side records expire earlier.

Essential and optional technologies

Strictly necessary functional storage generally does not require prior consent, but requires clear information. Non-essential tracking and privacy-sensitive analytics should not load until valid consent is collected, where legally required. Consent must be freely given, specific, informed, unambiguous, reversible and recorded where appropriate; no pre-ticked boxes. Describe each optional provider, purpose, retention and withdrawal method if actually enabled: N/A.

Hosted donation checkout

Where donations are enabled, explain any SumUp checkout redirect and any provider cookies or comparable browser storage after examining the actual checkout: **All donation payments are securely processed through SumUp, our third-party payment service provider.

When users choose to make a donation, they are redirected to SumUp's secure checkout environment to complete their payment.

Payment card details are handled directly by SumUp and are not stored on our platform's servers.

Our platform may store limited transaction information, including donation amounts, transaction dates, payment references, and payment statuses, for accounting, security, and legal compliance purposes.

After completing a payment, users may return to our platform through the designated return link provided during the checkout process.

Payment records are retained in accordance with our Donation Record Retention Policy and applicable Dutch and European Union legislation.

All donations are non-refundable, except where otherwise required by applicable law.**. The payment provider's cookies must not be mischaracterized as first-party ArchForge storage.

Browser controls

You can clear or block cookies using browser settings, but blocking the session cookie can prevent logging in. Browser push notifications use the browser permission system and can be disabled in site permissions. Clearing cached site data may also reset local preferences. Security-sensitive settings are not determined solely by cookies.

Changes and contact

Cookie inventories should be reviewed after adding analytics, advertising, chat widgets, external media or authentication technology. Contact information appears in the Legal Notice and Privacy Policy.

Changes and version history

This policy applies from its stated effective date once published. Material changes are dated and versioned. Earlier versions remain available to administrators for audit, and any notice or renewed agreement required by applicable law is handled separately. Questions and legally valid notices may be sent using the contact details in the Legal Notice.