Cookie policy

Barxad Status sets one cookie. It exists to keep a signed-in member of staff signed in. There is nothing else — no analytics, no advertising, no third-party scripts, and nothing that follows anyone between sites.

The one cookie

Name	Purpose	Lifetime
`bx_session`	Identifies the signed-in account so each page knows who is asking. It holds an account reference and a signature — no name, no password, nothing readable.	30 days, or until sign-out

It is set with these protections:

HttpOnly — page scripts cannot read it, so a script injected into the page could not steal a session.
Secure — only ever sent over HTTPS.
SameSite=Lax — not sent when another website triggers a request, which is what stops a hostile page acting as you.
Signed, and versioned — a tampered cookie is rejected, and revoking an account's sessions invalidates every cookie already issued to it, immediately.

Why there is no cookie banner

Consent is required for cookies that are not necessary to provide the service a person asked for — analytics, advertising, anything that profiles a visitor. This cookie is none of those: without it, signing in is impossible, which is the whole purpose of the office pages. A banner asking permission for the only thing that makes the site work would be theatre, and clicking "reject" would simply break it.

If analytics or any other non-essential cookie is ever added, this page will change and consent will be asked for properly, before it is set.

Tracking pages for clients

A cargo client opening a tracking link is not given a cookie at all. The page is read-only and needs no session. It is also marked so search engines do not index it.

Refusing it

Any browser can block cookies for this site. Public tracking pages will still work. Signing in will not, because there would be no way to carry the session from one page to the next.

Contact

Questions about this page: [email protected]. What is held about people, rather than how it is carried between pages, is covered by the privacy policy.