1. What these technologies are
Cookies are small values that a website stores in a browser and receives on later requests. Local storage remains in the browser until code or the user removes it. A server can also process request data without storing a cookie in the browser. These technologies have different privacy effects, so the table below identifies each one rather than calling all of them “cookies”.
2. Necessary cookies and storage
| Name | Type and provider | Purpose | Typical duration | Choice |
|---|---|---|---|---|
getremma-app-session |
First-party HTTP-only cookie; GetRemma/Laravel | Maintain login and form state and protect authenticated workflows | Normally 2 hours after inactivity; authenticated sessions also have a 12-hour absolute server-side limit | Required for requested session/account features |
XSRF-TOKEN |
First-party cookie; GetRemma/Laravel | Protect state-changing forms and requests against cross-site request forgery | Session/request lifecycle | Required for protected forms |
grm_locale |
First-party cookie; GetRemma | Remember an explicitly selected language | 1 year | Necessary preference |
grm_registration_device |
First-party HTTP-only cookie; GetRemma | Apply the registration limit and reduce automated account abuse. The random value is hashed before the server stores the registration window record | 30 days by default | Necessary for registration security |
grm_cookie_consent |
First-party cookie; GetRemma | Store the version, categories, choice and timestamp of the cookie-settings selection | 180 days | Necessary to remember and apply the choice |
grm_cookie_consent_v1 |
First-party local storage; GetRemma | Authoritative local copy of the same consent selection and timestamp | Rejected as invalid after 180 days | Necessary to remember and apply the choice |
The table states documented typical durations; a feature may use a shorter session or security lifetime depending on its configuration.
3. Optional analytics
GetRemma self-hosts Umami. It does not set an analytics cookie, but after the user accepts analytics its server creates session and visit hashes from technical request signals and records page and device-level analytics. For this reason, GetRemma treats it as optional analytics rather than as necessary storage.
The script loads only on an allowlist of public marketing pages after a valid analytics choice. The integration removes query strings, reduces referrer data to its origin, and does not call Umami's logged-in-user identification feature. Changing the selection to necessary-only, withdrawing it, or letting it expire blocks new Umami sends. Historical records are handled under the Privacy Policy and the approved analytics retention schedule.
4. Aggregate measurement without a tracker
When the privacy-safe baseline is enabled, GetRemma may count a request in an hourly aggregate even if optional analytics was not accepted. This layer does not write or read a visitor cookie or local-storage identifier and does not create a visitor/session ID. It stores only an allowlisted page, two-letter country, coarse source, allowlisted internal transition, UTC hour and count.
The request IP is used transiently against a local country database and is not stored in the aggregate. Query strings, raw referrers, city, browser, device and operating system are not stored. The legal basis, purpose and 25-month proposed retention are explained in the Privacy Policy. This layer must remain disabled until the documented legal and activation gates pass.
5. Marketing category
The settings interface reserves a marketing category, but the reviewed GetRemma implementation does not currently load a third-party advertising or marketing tracker when it is selected. GetRemma must update this policy and the consent interface before introducing one.
6. Managing your choice
On a first visit you can accept optional analytics, reject optional categories, or customize the selection. Use Cookie settings in the website footer to change it later. Rejecting or withdrawing must be as easy as accepting.
The interface exposes Aggregate site measurement separately when the baseline is enabled. Turning it off stores only a necessary objection preference and stops future baseline increments from that browser. Supported Global Privacy Control and Do Not Track signals must have the same effect. This safeguard is required before the aggregate baseline is enabled.
Deleting browser storage can make the banner appear again. Browser controls may also block all cookies, but login, protected forms, language memory or registration may then fail. A browser's Do Not Track signal is passed to the self-hosted analytics configuration; the explicit GetRemma selection remains the control for loading the tracker.
7. Contact and updates
For questions, contact support@getremma.com. GetRemma will publish a new effective date when technologies or purposes change materially and will request a new choice where required.