1. Introduction
This policy explains which cookies Pointet Workshop uses for authentication and language preferences, why they are used and how you can manage them. For broader information about personal data and your rights, read our Privacy Policy.
2. What Are Cookies?
Cookies are small pieces of information stored in or associated with your browser. They allow a website to recognise a session between requests or remember a preference, such as your selected language.
3. Cookies We Use
A. Strictly necessary / authentication cookies
- Access token (access_token): authenticates protected requests and maintains the authenticated user session.
- Refresh token (refresh_token): securely renews authentication when the access token expires or needs to be refreshed. Successful renewal replaces the refresh token and revokes the previous one.
These cookies are required for account authentication and session functionality. Their contents are authentication credentials, not advertising identifiers or ordinary profile information.
The default authentication cookie settings include:
- HttpOnly: prevents JavaScript running in the browser from directly reading the authentication cookies.
- Secure: restricts transmission to HTTPS when enabled.
- SameSite=Lax: limits cross-site cookie transmission and helps reduce certain cross-site request risks.
The local HTTP development setup disables Secure. The deployed HTTPS service must have it enabled; its live configuration has not yet been verified. These measures reduce risk but do not guarantee absolute security.
B. Preference cookies
Language / locale (NEXT_LOCALE): remembers the language selected for the public website. It contains a language code, not an access or refresh token. It uses SameSite=Lax and is separate from the HttpOnly authentication cookies.
The separate administration interface also uses a language-only cookie named admin_locale when an administrator changes language. It does not authenticate the administrator.
4. Strictly Necessary Cookies
Authentication cookies are necessary to log in, maintain an authenticated session, authenticate protected requests and securely renew authentication. They are not analytics, tracking or advertising cookies.
Cookies strictly necessary to provide a service you request do not require cookie consent under the applicable rules. The legal basis for processing the associated personal data depends on its purpose, as explained in the Privacy Policy; using a cookie does not automatically make consent the legal basis.
Removing or blocking these cookies may stop login and authenticated account features from working.
5. Preference Cookies
The public website uses NEXT_LOCALE only to remember your selected language. It may be set when your selected language differs from your browser preference, or updated when you change language. It helps preserve that choice as you move between pages.
No fixed expiry is configured for this cookie, so it is a session cookie rather than a promise to remember your choice indefinitely between visits. Your browser's session-restoration settings may preserve it after the browser is restarted. In the administration interface, admin_locale remembers the selected language between visits.
6. Cookie Duration
Session cookies have no fixed expiry and normally last for the browser session. Persistent cookies have an expiry or maximum age and can remain between visits until they expire or are deleted.
The application's configured defaults are:
- access_token: persistent, 15 minutes from issue or renewal.
- refresh_token: persistent, 30 days from issue or successful renewal. Renewal replaces the previous token and starts a new period.
- NEXT_LOCALE: session cookie; no Max-Age or Expires value is configured.
- admin_locale (administration interface only): persistent, 365 days from the most recent language selection; SameSite=Lax.
Authentication lifetimes can be changed through deployment configuration; these are the verified project defaults, not a measurement of a live deployment. Signing out clears the authentication cookies in that browser. Revocation may make a credential unusable before its cookie expires. Cookie expiry does not determine how long account, order or server-side session records are retained.
7. Third-Party Cookies
The website does not currently use third-party cookies for advertising or analytics. No embedded payment, external sign-in, analytics, advertising or support-widget integration that sets third-party cookies was identified in the current application.
The contact form opens WhatsApp as an external service after you submit the form. WhatsApp may use its own cookies when you visit it; those are governed by that service's cookie information. The website does not embed a WhatsApp tracking widget.
Product-media storage supports Amazon S3. Loading an image from a storage service is distinct from setting a cookie; no third-party cookie integration for this storage was identified.
8. Analytics and Advertising Cookies
The website does not currently use analytics or advertising cookies. There are no visitor-analytics or advertising cookie categories to enable. If this changes, this policy will be updated and any consent required for the new use will be obtained before those cookies are used.
9. Managing Cookies
You can view, block or delete cookies in your browser's privacy or site-data settings. Use your browser's help pages for the controls available on your device.
- Deleting authentication cookies may log you out.
- Blocking them may prevent authentication, session renewal and account-related features from working correctly.
- Deleting a language cookie may reset your preference; you can select a language again.
Browser cookie controls do not delete account or order records and do not stop processing that takes place independently of cookies. For personal-data requests, use the contact details below.
10. Changes to This Cookies Policy
We may update this policy when cookies are introduced, their purposes change, website functionality changes or legal requirements change. The Last updated date will identify the latest revision.