Cookies and storage
The short version
DamageBrief sets no advertising cookies, no analytics cookies and no tracking cookies. Nothing here profiles you, and nothing follows you to other websites.
Everything listed below is strictly necessary: it signs you in, protects the forms you submit, remembers the cookie choice you made, or keeps the app's own files so the installed app can start and can tell you when it is offline. Storage of that kind does not require your consent. It does still have to be explained, and that is what this page is for. The cookie banner records your choice anyway, so that if anything optional is ever added you will be asked before it is set.
Cookies DamageBrief sets
| Name | What it is for | How long it lasts |
|---|---|---|
session_id |
Keeps you signed in. It holds only a signed reference to your sign-in session; the session itself (when you signed in, your IP address and browser) is kept on DamageBrief's server. | Until you sign out, or until your sign-in session ends on DamageBrief's server — after 14 days without use, and 60 days after you signed in at the latest (your browser is told to keep it for those 60 days) |
_crash_estimator_session |
Protects every form you submit against forgery (a security token), carries the one-line confirmation shown after an action, and remembers which page to open after you sign in. | Until you close your browser |
damagebrief_privacy |
Remembers the cookie choice you made, so the banner does not ask again on every page. Holds a random identifier and your choices — nothing about you. | 6 months |
Security cookies set by Cloudflare
DamageBrief is served through Cloudflare, which protects it from attacks and automated abuse. Cloudflare may set its own cookies before a request ever reaches us. Whether you see any of them depends on Cloudflare's protection settings rather than on anything in DamageBrief.
| Name | What it is for | How long it lasts |
|---|---|---|
__cf_bm |
Security: tells people from automated traffic. | 30 minutes |
_cfuvid |
Security: applies rate limits fairly to visitors who share an address. | Until you close your browser |
cf_clearance |
Security: records that a security challenge was passed. | As set in Cloudflare's challenge settings, at most 1 year |
Other things stored on your device
| Name | What it is for | How long it lasts |
|---|---|---|
damagebrief-static-… |
Offline cache of the app (browser Cache Storage, kept by DamageBrief's service worker): DamageBrief's own styles, scripts, fonts and icons and the page shown when there is no connection — so the app opens quickly and, offline, says so. It never holds a page of the app, a case, a photo, a document or a report, and nothing about you. | Until the next DamageBrief release replaces it, or you clear this site's data |
Other companies your browser contacts
-
Cloudflare Turnstile (
challenges.cloudflare.com), on the sign-in forms (the sign-in page and the landing page's sign-in dialog) and the contact form — on the landing page only once you open the sign-in or start writing a message: checks that a real person is signing in or writing to us, rather than a script trying to break into accounts or flood the inbox. It is a security control, not analytics or advertising. Its check runs in a frame from Cloudflare, which sees your IP address and characteristics of your browser for it. -
OpenStreetMap map tiles (
tile.openstreetmap.org), on case pages, for signed-in users only, where a crash location is shown or picked on a map: draw the map. Your browser fetches the map images directly from the tile server, which therefore sees your IP address and which part of the map is shown — but not which page you are on, nor anything about the case. No cookie is involved.
That is the complete list. No other outside code runs on DamageBrief's pages.
Managing this
You can change your cookie choice at any time on the cookie preferences page. Your browser settings also let you clear this site's data; because everything above is strictly necessary, clearing it signs you out and nothing else changes. How DamageBrief handles personal data in general is in the privacy policy.