Cookie & Session Policy

Introduction

This Cookie & Session Policy explains how Prayagh FactoryFlow uses cookies and local browser storage to manage user sessions, ensure system security, and maintain user interface preferences.

Because Prayagh FactoryFlow is a secure internal application, we only use strictly necessary cookies. We do not use any cookies for advertising, marketing, or third-party tracking.

What Are Cookies?

Cookies are small text files stored on your computer or mobile device when you visit a website. They allow the application to remember your actions and secure your logged-in state across different pages.

Cookies We Use

Prayagh FactoryFlow relies entirely on JSON Web Tokens (JWT) for authentication. To protect against Cross-Site Scripting (XSS) attacks, these tokens are never exposed to the frontend JavaScript. Instead, they are securely transmitted via the following cookies:

Security Attributes

Both of the authentication cookies listed above are deployed with the highest security standards:

• HttpOnly: They cannot be accessed or stolen by malicious JavaScript (XSS protection).
• Secure: They are only transmitted over encrypted HTTPS connections.
• SameSite=Lax: They are sent along with same-site requests and with top-level navigation from other sites but not with cross-site subrequests (e.g., images, iframes, or AJAX).

Administration Console Cookie

System administrators who sign in to the separate administration console receive one additional cookie, sys_admin_token, which verifies the administrator’s session. It is HttpOnly, Secure, andSameSite=Strict, and expires after 8 hours. Regular users never receive this cookie.

Session Management & Logout Behavior

Prayagh FactoryFlow operates statelessly. When you successfully log in, the server generates the ff_access and ff_refresh cookies.

When you click Logout, the server actively instructs your browser to delete both cookies, instantly terminating your session. Due to the strict 15-minute expiration on the access token, any stolen or lingering token naturally expires very quickly.

Other Browser Storage (Local Storage)

In addition to cookies, Prayagh FactoryFlow utilizes your browser’s Local Storage mechanism to remember non-sensitive user interface preferences. This data remains on your local machine and is never transmitted to our servers.

• factoryflow-ui: Remembers your layout preferences, such as whether you have collapsed or expanded the main sidebar navigation.
• theme: Remembers your visual preference between Light Mode, Dark Mode, or System settings.
• whats-new-seen-version: Remembers which release notes (the “What’s new” summary) you have already seen, so they are not shown again.
• maintenance:dismissed: Remembers which scheduled-maintenance banner you have dismissed.

None of the items above contains your name, email address, password, or any business data, and none is used for advertising. You can clear them at any time from your browser settings; the application will simply reset those preferences.

Analytics & Tracking

Prayagh FactoryFlow is an internal operational tool. We do not use any analytics, tracking, or marketing cookies. There are no third-party integrations designed to monitor your browsing behavior across the web.

For diagnostics only, the application uses Sentry to report errors and measure application performance. We do not record or replay your screen or sessions. This data is used solely to identify and fix defects in the software and is not used for advertising, profiling, or any purpose outside operating and improving the application. See the Privacy Policy for details.

The application’s fonts are bundled with and served by the application itself; no external font service is contacted from your browser.

Changes to this Policy

This policy may be updated as the application changes. The “Last updated” date at the top of this page shows when it last changed. Continuing to use the application after an update means you accept the updated policy.