Cookie Policy

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites function efficiently, improve the user experience, and provide information to the site owner.

Similar technologies — such as local storage and session storage — serve comparable purposes and are covered by this policy.

Shimaya uses cookies for the following purposes:

• —Authentication: to keep you logged in securely across sessions. These cookies are essential and cannot be disabled.
• —Session management: a session token keeps you logged in so you do not need to re-enter your credentials on every page.
• —Security: CSRF protection tokens prevent cross-site request forgery attacks.
• —Preferences: remembering your timezone and notification settings within the platform.
• —Analytics: aggregate, anonymised data on how pages are used — no personal identifiers are stored in analytics cookies.

Strictly necessary cookies

• —shimaya-session — Authentication session token. Session-scoped; deleted when you close the browser.
• —shimaya-refresh — Authentication refresh token. Persists for 7 days to keep you logged in.
• —__Host-next-auth.csrf-token — CSRF protection for form submissions.

Functional cookies

• —shimaya-tz — Stores your selected timezone so the dashboard displays times correctly.
• —shimaya-theme — Stores your display preference if a theme toggle is added in future.

Analytics cookies (optional)

• —We may use anonymised, aggregated analytics in future. No personal data or tracking identifiers are used.
• —No third-party advertising or cross-site tracking cookies are set.

Shimaya integrates with the following third-party services that may set their own cookies:

• —Authentication provider: sets session cookies to manage your login. No personal data beyond session identifiers is stored.
• —Stripe: if you subscribe to a paid plan, Stripe sets cookies for fraud prevention and payment session management.
• —Vercel: our hosting provider may set performance cookies. These contain no personal data.

We do not use cookies from advertising networks, social media platforms, or cross-site tracking services.

• —Session cookies: deleted when you close your browser.
• —Persistent cookies (authentication): retained for up to 7 days after your last login.
• —Preference cookies: retained for up to 1 year, or until you clear them manually.

You can control cookies through your browser settings. Most browsers allow you to block, delete, or restrict cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to Shimaya.

• —Chrome: Settings → Privacy and Security → Cookies and other site data.
• —Firefox: Preferences → Privacy & Security → Cookies and Site Data.
• —Safari: Preferences → Privacy → Manage Website Data.
• —Edge: Settings → Cookies and site permissions.

You can also clear all cookies for shimaya.app at any time. Doing so will log you out and reset any saved preferences.

Some browsers send a "Do Not Track" (DNT) signal. Shimaya honours DNT signals: when detected, we disable any optional analytics cookies and do not collect usage data beyond what is strictly necessary to operate the Service.

We may update this Cookie Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify account holders by email. Continued use of the Service after any change constitutes acceptance of the revised policy.

For questions about our use of cookies:

• —Email: privacy@shimaya.app
• —Response time: within 5 business days