In short

Everything we store in your browser is strictly necessary to sign you in or to remember your own display choices. We do not use advertising, analytics or tracking cookies, and we do not load third-party scripts. Because nothing here needs your consent, we do not show a cookie banner.

Cookies

• refresh_token — workspace dashboard. Only used when enhanced session security is enabled. When it is, our API sets it at sign-in and it lets the session be renewed without asking for the password again. HTTP-only, Secure, SameSite=None, valid for 30 days and replaced each time it is used. Removed when you sign out. • admin_refresh_token — platform admin area. The same cookie for platform staff, with a name of its own so that the two can never be mixed up. Same condition, settings and lifetime. The public website (the landing, register, help and legal pages) sets no cookies.

Browser storage (localStorage)

Website: • workan-theme-storage — your light, dark or system theme. • workan-language-storage — your language (English or Arabic). Workspace dashboard (your workspace address): • auth_token — the sign-in token for your session. • workan-auth-storage — your signed-in profile (such as name, email and permissions) so the app can draw itself on reload. It does not contain the token. • workan-theme-storage, workan-language-storage — as above. • workan-tenant-layout — whether you prefer the sidebar or the top navigation. • workan-onboarding-dismissed — remembers that you closed the set-up checklist. Platform admin area: • admin_token — the sign-in token for a staff session. • workan-admin-auth-storage — the signed-in profile, without the token. • workan-admin-impersonation — the workspace and owner shown in the impersonation banner, so it survives a reload, without the access token. • workan-admin-layout, workan-theme-storage, workan-language-storage — display choices, as above. We also keep your theme, language, layout and table preferences on your account on our servers so they follow you between devices; that is account data, not browser storage.

Fonts and third parties

Our fonts are served from our own domain, so loading a page does not send your visit to a font provider. We do not embed analytics, advertising or social-media widgets.

Managing them

You can delete cookies and site data in your browser settings at any time. Doing so signs you out and resets your theme, language and layout on that device. If you block these cookies and storage altogether, you will not be able to sign in.

Changes and contact

If we ever add a cookie or storage item that is not strictly necessary, we will update this notice and ask for your consent first. Questions? Email privacy@workan.space.