Politica de cookie-uri

What are cookies?

Cookies are small text files a site stores on your device. Some of what we describe below is not a cookie at all but browser localStorage — data that stays in your browser and is never sent to a server. We list both, because the distinction matters less to you than knowing what is stored.

polimorf runs on separate origins and each stores different things. This page covers all of them.

This marketing site (polimorf.md)

Cookies

• pmf_locale — remembers whether you are reading in English, Romanian or Russian, so the site opens in the language you last chose. Set only when a language is selected or detected. This is the only cookie this site sets.

Local storage

• polimorf:theme — dark or light appearance.
• polimorf:density — comfortable or compact spacing.
• polimorf:nav — whether the navigation is open or closed.

These three are read before the page paints so it does not flash the wrong theme at you. They stay in your browser and we never receive them.

The application (crm.polimorf.md)

The CRM is a single-page app served from one origin, and it authenticates with cookies rather than tokens held in the page. Both cookies carry the __Host- prefix, which forces Secure, forbids a Domain attribute and pins them to that one exact origin — no other subdomain can read or overwrite them.

Strictly necessary

• __Host-polimorf_session — keeps you signed in. HttpOnly, Secure, SameSite=Lax, Path=/. The value is random and meaningless on its own; the server stores only a hash of it, so a database dump yields no usable session. It is replaced with a new value when you sign in, complete multi-factor authentication, re-authenticate for a sensitive action, switch workspace, or change your credentials.
• __Host-polimorf_csrf — protects against cross-site request forgery. Secure, SameSite=Lax, Path=/, and deliberately readable by the app's own JavaScript, which must echo it back in a request header. It is a signed value tied to your session, not an identifier that follows you.

Neither can be turned off: without them there is no way to stay signed in or to submit anything safely. Signing out revokes the session on the server and clears both. How long a session lasts before it goes idle, and its hard maximum age, are set by your workspace administrator.

Signing in through a single sign-on provider briefly sets one short-lived cookie to tie the round-trip together. It expires within minutes and holds no personal data.

Public links

Document signing and viewing links, file downloads, unsubscribe pages and the data-deletion request form are served from a separate origin that sets no cookies at all. Access there is by a signed, single-purpose, short-lived link. That origin refuses to start if any response would carry a cookie, and a test enforces it on every build.

Analytics

There are none. We run no third-party analytics, no advertising pixels and no tracking scripts on either the marketing site or the application, so there is nothing to consent to and no banner to dismiss. If that ever changes, this page changes first and consent will be asked for before anything is set.

Managing cookies

You can clear or block cookies in your browser settings. Blocking them on this site loses only your language preference. Blocking them on crm.polimorf.md signs you out and prevents you from signing back in.

Updates

This policy is updated as our cookie usage changes. The "Last updated" date at the top reflects the current revision.