How SCYNEXUS uses cookies and browser storage.

1. Public Portal

The Public Portal uses locale-prefixed routes and does not currently set its own HTTP cookies or browser-storage values. Reading public pages does not require an SCYNEXUS account.

2. Authentication and consent cookies

When you choose a configured OAuth/OIDC identity provider, the Auth Service sets a cookie named scynexus_oidc_[provider]_state. It protects the sign-in redirect by retaining state, nonce, PKCE, return-path, and expiry information. It is HTTP-only, SameSite=Lax, secure when HTTPS is used, and expires after ten minutes.

The Auth Service uses scynexus_terms_consent and scynexus_cookie_policy_consent to restore the checked state of the Terms of Service and Cookie Policy controls. Each client-readable cookie contains only the accepted policy version—not the folder path, credentials, or account data—and uses Path=/, SameSite=Lax, Secure on HTTPS, and a maximum lifetime of 180 days.

Provider sign-in may fail if its essential state cookie is blocked. Consent checkboxes return to unchecked when their corresponding consent cookie is absent, expired, or removed.

3. Persistent browser-local storage

The Auth Service stores the selected chain folder path and main-chain action in local storage only when you select Remember this folder path in this browser. This allows Open an existing main chain to remain selected on a later visit. The MVP Terms acceptance record also uses local storage and remains until the application or user removes it.

The Terms record contains the draft version, acceptance time, and whether path saving was selected; it does not duplicate the folder path. It is an MVP convenience record, not production-grade legal evidence.

4. Session storage

When path remembering is not selected, the chain folder path and main-chain action are kept in session storage for the current browser session only. After successful local authentication, the Auth Service also stores the session token there so the Identity page can access the authenticated account. Session storage is normally cleared when the browser tab or session ends.

5. External identity providers

Google, Microsoft, ORCID, Gov.br, Auth0/Okta, GitHub, or other providers may use their own cookies when you leave SCYNEXUS for authentication. Their policies and controls apply on their domains. SCYNEXUS does not control those third-party cookies.

6. Your controls

You can inspect or clear cookies, local storage, and session storage through browser settings. Unchecking either authorization control removes its corresponding consent cookie. Clearing cookies resets the checkboxes; clearing browser storage may also remove the saved chain path, main-chain choice, Terms record, current session, or provider sign-in state.

Blocking consent cookies means those authorizations will not remain checked between visits. Blocking the essential provider-state cookie does not prevent access to public information, but it may prevent provider authentication from completing.

7. Changes and contact

This policy should be updated if analytics, preferences, additional authentication storage, or other tracking technologies are introduced. Formal privacy or data-protection contact details will be added before production release.