# Cookies & Similar Technologies Notice
Notice for browser storage, authentication and measurement technologies.

## 1. Scope and application
This V1 notice covers cookies and similar technologies on Tessen websites and browser-based services, including Web and Platform. Comparable application storage and device identifiers may also be used in mobile or desktop products and require appropriate product-specific disclosure. Publication of this notice does not establish that a consent manager has been deployed or that an exhaustive storage scan is complete.

Cookies are browser-stored values. Similar technologies can include local/session storage, pixels, SDK identifiers and device or request identifiers. They may serve different purposes and have different consent requirements. Calling a value “technical” does not automatically make it legally essential.

## 2. Essential service functions
Authentication/session continuity, security, permission state and request-routing functions may require storage or identifiers to provide a user-requested service. Their exemption from consent, if any, must be assessed against actual purpose and applicable law. They should not be reused for unrelated tracking without the required basis.

Users who block genuinely necessary storage may be unable to sign in or maintain certain preferences. The Web session cookie tessen_cloud_session is host-only, Secure, HttpOnly and SameSite=Lax, with an eight-hour lifetime. OAuth state, PKCE and return-path cookies support the login handoff; Auth production disables cross-subdomain cookies. These examples do not establish a complete inventory of every preference, integration or authenticated product flow.

## 3. Preferences and optional measurement
Preferences may remember language, display choices or user-requested settings. Analytics may measure visits, performance or feature use. Advertising, cross-service tracking and profiling raise separate issues; this notice does not make a blanket assertion about their presence or absence across every product.

Cloudflare Web Analytics loads a Cloudflare-hosted beacon on Web and Platform public pages and sends same-origin performance/usage telemetry to /cdn-cgi/rum. Fresh anonymous observations found no cookies or local/session-storage keys during those loads; this does not establish the behavior of all authenticated or embedded features. Optional categories must not be pre-enabled where valid consent is required. A category label should not obscure several materially different purposes.

Cloudflare Web Analytics was observed on ordinary public Web and Platform browser loads, including its hosted beacon and same-origin /cdn-cgi/rum submission. The anonymous observation did not find cookies or local/session-storage keys on those particular page loads. This narrows the technical inventory; it does not establish every authenticated/product flow, provider retention or a universal consent exemption. Final disclosure and choice treatment require the approved current inventory and applicable jurisdictional assessment.

## 4. Consent and choice design
Where consent is required, explain the purposes clearly before optional technology runs and provide a genuine choice. Acceptance and rejection should be accessible, understandable and available without misleading design. Consent should be specific enough for the actual purposes, and withdrawal should be practical without implying loss of unrelated essential functionality.

Where applicable law requires consent or an opt-out, the relevant optional technology must be subject to the required choice before activation. Withdrawal and recognized privacy signals must be handled according to their applicable legal effect. This notice does not certify that a banner or signal-processing mechanism is already working.

## 5. Inventory and third-party content
The completed inventory should identify name or identifier, provider, domain, purpose, category, personal data involved, duration/expiry, first- or third-party status and the activation condition. Session and persistent storage should be distinguished. Do not invent a duration from a vendor’s default documentation without checking actual configuration.

Embedded media, sign-in tools and linked third-party sites may introduce their own storage and tracking. The final page should explain which technologies run on Tessen and which are encountered only after leaving it or intentionally loading third-party content. A hyperlink alone is not necessarily a tracking integration.

## 6. Managing browser and application storage
Browser settings can block or delete cookies and site data. Deletion can sign you out or reset preferences but may not stop future storage or erase server-side records. Private browsing does not guarantee that service providers cannot receive request information. Device settings may provide additional application permissions and identifier controls.

Use the relevant implemented privacy controls or contact Tessen for information about the actual mechanisms. This site does not present a fake preference button that claims to update consent without a connected consent system. Consent controls must be implemented and verified before the final notice refers to them as available.

## 7. Retention, security and privacy relationship
Storage duration should be limited to the purpose and accurately disclosed. Associated server-side information follows the applicable data-retention process rather than a cookie expiry alone. Cookies and similar technologies should not contain exposed authentication secrets beyond the protection appropriate to their design.

The [Privacy Notice](/legal/privacy) addresses purposes, recipients, international processing, retention criteria and rights. This notice supplements it for device/browser technologies and does not supply a universal lawful basis for personal-data processing.

## 8. Changes and contact
Review this notice when introducing a new domain, SDK, embedded service or tracking purpose. Material changes may require renewed choice rather than a silent text update. Keep the inventory and consent implementation synchronized with the published version.

Questions about this notice may be sent to hello@tessen.ai. The contracting entity and personal-data processing roles are described in the Terms and Privacy Notice.