Xavio
What Xavio actually stores
Only what signing in and using the application needs:
- xavio-session — the session cookie. It holds no personal data, only the key to the session kept on the server. Lifetime 2 hours; it is
httpOnly,secureandSameSite=Lax. - XSRF-TOKEN — protects forms against being submitted from another site. Same lifetime.
- remember_web_… — only if you tick “remember me” when signing in.
- flux.appearance — in local storage, not a cookie: whether you chose the light or the dark theme.
- xavio:traseu — in session storage: the trail of pages you came through, so the “Back” button goes back the way you came. It is cleared when you close the tab.
Why there is no consent banner
Because everything above is strictly necessary for the service you asked for, and the law does not require consent for that. There is no advertising cookie, no tracking cookie, and no analytics tool — so there is nothing to ask you about. If that ever changes, the consent mechanism will be in place before the change, and this page will say so.
The one thing that goes outside
These public pages load the Sora and Inter typefaces from Google Fonts, which means Google receives the IP address of the visitor loading them. No cookie is set by that request. Nothing else on these pages comes from another domain.
How to remove them
Any browser can delete cookies and site data for a site, and block them. Deleting them signs you out of Xavio and forgets your theme choice; nothing else is lost, because the data lives on the server, not in the browser.