Cookie Governance

1. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They allow the platform to remember your preferences, maintain your session, and understand how the service is being used.

2. Cookies We Use

Alpas uses only the categories of cookies necessary to operate the platform:

• Strictly Necessary — Session tokens and authentication cookies required to keep you logged in and enforce tenant isolation. Cannot be disabled.
• Functional — Stores your UI preferences (e.g., sidebar state, selected academic term) to improve your experience across sessions.
• Analytics — Aggregated, anonymised usage data to help us understand feature adoption. No personal identifiers are collected. Tenants may opt out via their account settings.

We do not use advertising, retargeting, or third-party tracking cookies.

3. Session & Authentication Cookies

Authentication is handled via JWT tokens stored in HTTP-only cookies. This approach prevents client-side JavaScript from accessing the token, significantly reducing exposure to cross-site scripting (XSS) attacks. Tokens expire after a configurable inactivity period set by each institution.

4. Third-Party Services

Some platform features may load content from trusted third-party providers (e.g., embedded maps, document viewers). These services may set their own cookies subject to their own privacy policies. We limit third-party integrations to those strictly necessary for the contracted service.

5. Managing Cookies

You may control non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging into the platform. Most modern browsers allow you to:

• View and delete stored cookies.
• Block cookies from specific sites.
• Set preferences for first-party vs. third-party cookies.

6. Changes to This Policy

We may update this Cookie Governance policy as the platform evolves. Material changes will be communicated to Tenant administrators via the platform notification system at least 14 days before taking effect.

7. Contact

For questions about our use of cookies, please contact us at hello@alpas.app.