Legal · /legal/cookies
Cookies
Every cookie Taptime sets, what it is for and how long it lasts. Taptime sets no advertising or analytics cookie and embeds nothing from another site.
The cookies Taptime sets
All of them are necessary to sign in and to record a shift. There is no advertising cookie, no analytics cookie and nothing embedded from another site — every stylesheet, typeface and script this product loads is served from this domain, so no third party is contacted by opening a page.
| Name | What it is for | Lifetime | Sent to |
|---|---|---|---|
| tappa_session | Remembers which employee this phone belongs to, so a tap at a plaque knows who tapped. Set once, when the personal invitation link is opened. | 365 days | / |
| tappa_activation | Carries the invitation while the phone is being set up, so the code stays out of the address bar, out of browser history and out of any link that leaves this site. Once the privacy notice is accepted it also marks this browser as the one that accepted it, so only this browser's first tap on a plaque can finish setup. Cleared as soon as the invitation is used. | until the invitation expires (at most 30 days) | / |
| tappa_activated | Set for a few minutes right after a phone finishes setup, so the setup page that is still open in another tab can tell that it was THIS setup that finished. It holds no password and no code. | 15 minutes | / |
| tappa_admin_session | Keeps a manager signed in to the dashboard. A separate cookie from the employee one, sent only to the dashboard, so neither can be used in the other's place. | 12 hours | /admin |
| tappa_admin_login | Protects the dashboard sign-in form against being submitted from another site. Exists only while somebody is on the sign-in page. | 15 minutes | /admin |
| tappa_admin_choice | Set only when one person manages more than one organisation: it carries the choice being offered, signed by this server, between the password step and the pick-a-business step. | 5 minutes | /admin |
| tappa_admin_confirm | Set for a moment when a manager is asked to confirm something that cannot be undone, so the confirmation belongs to that manager, that session and that one action. | 10 minutes | /admin |
| tappa_admin_reset | Protects the 'I cannot get in' form against being submitted from another site. Exists only while somebody is on that page. | 15 minutes | /admin |
| tappa_admin_verify | Carries an email confirmation link from the email to the button that confirms it, so the link stays out of the address bar and out of browser history. Cleared when the button is pressed. | 30 minutes | /admin |
| tappa_admin_link | Carries the link that adds your other businesses to your sign-in, from the email to the button that confirms it, so the link stays out of the address bar and out of browser history. Cleared when the button is pressed. | 30 minutes | /admin |
| tappa_admin_invite | Carries an invitation link while it is being accepted, so the link stays out of the address bar and out of browser history, and protects that page against being submitted from another site. Cleared as soon as the invitation is accepted or found unusable. | 30 minutes | /admin/invite |
| tappa_admin_reset_link | Carries a recovery link while a new password is being chosen, so the link stays out of the address bar and out of browser history. Cleared as soon as the link is used or refused. | 1 hour | /admin/reset/new |
| tappa_signup | Protects the registration form against being submitted from another site. Exists only while somebody is filling the form in. | 30 minutes | /signup |
| tappa_signup_state | Carries the answers already given — the business name, the VAT number and the places — from one step of the registration form to the next, signed by this server. It never holds a password or an email address. Cleared once the "check your inbox" page has been shown. | 30 minutes | /signup |
| tappa_signup_claim | Carries a registration link while it is being confirmed, so the link stays out of the address bar and out of browser history. Cleared as soon as the registration is finished or the link is refused. | 30 minutes | /admin/signup/confirm |
tappa_session
Remembers which employee this phone belongs to, so a tap at a plaque knows who tapped. Set once, when the personal invitation link is opened.
- Lifetime
- 365 days
- Sent to
- /
tappa_activation
Carries the invitation while the phone is being set up, so the code stays out of the address bar, out of browser history and out of any link that leaves this site. Once the privacy notice is accepted it also marks this browser as the one that accepted it, so only this browser's first tap on a plaque can finish setup. Cleared as soon as the invitation is used.
- Lifetime
- until the invitation expires (at most 30 days)
- Sent to
- /
tappa_activated
Set for a few minutes right after a phone finishes setup, so the setup page that is still open in another tab can tell that it was THIS setup that finished. It holds no password and no code.
- Lifetime
- 15 minutes
- Sent to
- /
tappa_admin_session
Keeps a manager signed in to the dashboard. A separate cookie from the employee one, sent only to the dashboard, so neither can be used in the other's place.
- Lifetime
- 12 hours
- Sent to
- /admin
tappa_admin_login
Protects the dashboard sign-in form against being submitted from another site. Exists only while somebody is on the sign-in page.
- Lifetime
- 15 minutes
- Sent to
- /admin
tappa_admin_choice
Set only when one person manages more than one organisation: it carries the choice being offered, signed by this server, between the password step and the pick-a-business step.
- Lifetime
- 5 minutes
- Sent to
- /admin
tappa_admin_confirm
Set for a moment when a manager is asked to confirm something that cannot be undone, so the confirmation belongs to that manager, that session and that one action.
- Lifetime
- 10 minutes
- Sent to
- /admin
tappa_admin_reset
Protects the 'I cannot get in' form against being submitted from another site. Exists only while somebody is on that page.
- Lifetime
- 15 minutes
- Sent to
- /admin
tappa_admin_verify
Carries an email confirmation link from the email to the button that confirms it, so the link stays out of the address bar and out of browser history. Cleared when the button is pressed.
- Lifetime
- 30 minutes
- Sent to
- /admin
tappa_admin_link
Carries the link that adds your other businesses to your sign-in, from the email to the button that confirms it, so the link stays out of the address bar and out of browser history. Cleared when the button is pressed.
- Lifetime
- 30 minutes
- Sent to
- /admin
tappa_admin_invite
Carries an invitation link while it is being accepted, so the link stays out of the address bar and out of browser history, and protects that page against being submitted from another site. Cleared as soon as the invitation is accepted or found unusable.
- Lifetime
- 30 minutes
- Sent to
- /admin/invite
tappa_admin_reset_link
Carries a recovery link while a new password is being chosen, so the link stays out of the address bar and out of browser history. Cleared as soon as the link is used or refused.
- Lifetime
- 1 hour
- Sent to
- /admin/reset/new
tappa_signup
Protects the registration form against being submitted from another site. Exists only while somebody is filling the form in.
- Lifetime
- 30 minutes
- Sent to
- /signup
tappa_signup_state
Carries the answers already given — the business name, the VAT number and the places — from one step of the registration form to the next, signed by this server. It never holds a password or an email address. Cleared once the "check your inbox" page has been shown.
- Lifetime
- 30 minutes
- Sent to
- /signup
tappa_signup_claim
Carries a registration link while it is being confirmed, so the link stays out of the address bar and out of browser history. Cleared as soon as the registration is finished or the link is refused.
- Lifetime
- 30 minutes
- Sent to
- /admin/signup/confirm
Every cookie is HttpOnly · SameSite=Lax · Secure. Secure is set whenever Taptime is served over https, which is every deployment that is not a developer's own machine. HttpOnly means no page script can read the value.
This text has not been published yet
Nothing on this page is in force. It is a placeholder so the document has an address before it has a text, and it will be replaced with the real one — no part of it should be relied on in the meantime.
Waiting on
- The controller and contact point, as for the privacy policy.
- Confirmation of the legal basis: these cookies are the ones without which the service cannot be delivered, which is the basis this document will state.