1. What kiweely uses
| Technology | Purpose | Duration |
|---|---|---|
| __session | Opaque signed-in website session. Secure, HttpOnly, SameSite=Lax; the server stores only its hash. | Rotating session lifetime or sign-out/revocation. |
| CSRF state | Binds authentication and sensitive browser actions to the initiating session/origin. | One attempt or short security lifetime. |
| Identity-provider session | Google Identity Platform sign-in and security. | Under the active provider's settings and notice. |
| Email-link continuation | Temporarily keeps the entered email address in this browser so the returning secure link can be completed, including after a new tab opens. | Until link completion or browser-site data is cleared. |
2. Counting website visits
Public website pages count visits through Umami, served from kiweely.com itself. It writes no cookie and stores nothing on your device, so there is nothing to consent to and nothing to clear. It records the page, the site that linked to you, and the country, browser and device type your request already reveals; kiweely keeps no address of yours for it, and the provider is listed on subprocessors with its own notice. It does not run on the account portal or the sign-in page, and it cannot follow you to another website.
3. What is not used today
The kiweely website does not place advertising, cross-site tracking, social-media, or behavioral profiling cookies. It does not fingerprint visitors for advertising. Necessary security rate limits may process network signals.
4. Your controls
You can block/delete cookies in browser settings, but necessary account flows may stop working. Sign out to revoke the current kiweely browser session or use Settings to revoke another session/all sessions. If optional technologies are introduced, we will update this Notice and provide consent controls where required before using them.