1. Essential session
The signed Flask cookie named session supports login, CSRF protection, temporary messages and language preference. It is used for the browser session; signing out ends the authenticated state. Document contents and passwords must not be placed in the cookie.
2. Analytics and marketing
The reviewed application source does not integrate Google Analytics or marketing pixels. An accept-all banner is not added for the essential session alone. Any future non-essential analytics or marketing must be assessed and implemented with appropriate prior choice and withdrawal controls.
3. External resources
Some document views load PDF rendering and date-picker libraries from external CDNs. This establishes a network connection to the provider even where no separate cookie is set. This notice must be updated when external resources change.
4. Browser controls
Cookies can be deleted or blocked in your browser. Blocking the session cookie may prevent login, persistent language selection and secure form submission.