Jurisimus — Cookie Policy (DRAFT)
STATUS: DRAFT — NOT IN FORCE. NOT LEGAL ADVICE. Prepared 2026-07-11 for review by Thai counsel. Pairs with the consent-banner spec in
../legal-readiness-plan-2026-07-11.md§ 3. PDPA requires prior opt-in consent for non-essential cookies: no pre-ticked boxes, reject as prominent as accept, withdrawal as easy as consent, consent records retained.
Effective date: [DATE] · Version: [v1.0]
1. What cookies we use
Strictly necessary (no consent required — cannot be switched off)
| Cookie | Purpose | Duration |
|---|---|---|
access_token / session cookies | authentication and session management | session / [X days] |
| CSRF token | request-forgery protection | session |
| cookie-consent record | stores your consent choices | [12] months |
Analytics (consent required — OFF until you opt in)
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
PostHog cookies (ph_*) | PostHog | product analytics: feature usage, funnels, session behavior | [12] months |
We do not use advertising or cross-site tracking cookies.
2. Consent
On your first visit we show a banner where you can Accept or Reject analytics cookies with equal prominence. Analytics tools are not loaded and set no cookies until you accept. We record your choice (timestamp, choice, policy version) as PDPA-required evidence of consent.
3. Withdrawing consent
You can change or withdraw your consent at any time via Cookie settings (footer link / in-app settings). Withdrawal takes effect immediately for future processing; we also stop loading the analytics tools and delete/expire their cookies where technically possible.
4. Managing cookies in your browser
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will break sign-in.
5. Changes
We will update this page and re-prompt for consent if we add new non-essential cookie categories.
Questions: [privacy@jurisimus.com].