Cookie Notice
Breno sets two cookies, both of them to keep you signed in, and neither of them readable by page scripts. Everything else the browser remembers is your own preferences, stored locally and never sent to the server. There are no analytics, advertising or third-party tracking cookies.
Last updated: 9 October 2026
1. The cookies we set
Both cookies are set by this application itself, not by a third party, and both are strictly necessary — without them you cannot stay signed in.
| Name | What it is for | Lifetime | Attributes |
|---|---|---|---|
token | Your session. The BFF sends it to the API as a Bearer credential on your behalf. | 24 hours | HttpOnly; Secure in production; SameSite=Lax; Path=/ |
refresh_token | Renews the session after the short-lived access token expires. It is sent only to the refresh endpoint, never with ordinary requests. | 14 days | HttpOnly; Secure in production; SameSite=Lax; Path=/api/auth |
HttpOnly means the cookie cannot be read by JavaScript, so a script injected into a page cannot steal your session. The session token is never written to localStorage. On logout both cookies are cleared.
Two further names may appear in a browser that has used an older version of the product: sirmx_edition, which is no longer set and is cleared when you log out, and the workspace hints breno_active_workspace and sirmx_active_org, which are only read as a fallback when deciding which workspace a request belongs to. Nothing in this version writes them.
2. Why there is no consent banner
Every cookie above is strictly necessary to deliver the service you asked for — signing in and staying signed in. There is no analytics cookie, no advertising cookie, and no third-party cookie of any kind, so there is nothing to ask your permission for.
If the operator of an instance adds analytics or any other non-essential cookie, this notice no longer describes that instance and a consent mechanism would be required.
3. Storage in your browser (not cookies)
The application also remembers some settings locally. This storage stays in your browser, is never sent to the server, and is not a cookie — deleting it costs you nothing but the preferences it holds.
In local storage:
cb-theme— whether you chose the light or dark interface.cb_user— a cached copy of your own profile, so the interface can render immediately instead of waiting for a round trip. It holds no credential.- Preferences:
breno-default-depth,breno-autonomy-max-level,breno-tts-voice,breno-tts-rate,breno-library-view,breno-library-sort,breno-sidebar-collapsed. - One-time notices you have already dismissed:
breno-intro-seen,breno-install-dismissed,breno-verify-banner-dismissed,breno-howto-*.
In session storage
A handful of values that only need to survive while the tab is open: where to send you after signing in (post_login_redirect), a first-login hint, whether the splash screen has been shown, and the transient state and nonce values that protect the Google, GitHub and OIDC sign-in round trips. They are removed as soon as the sign-in completes. Closing the tab clears all of it.
4. Nothing else
There is no analytics service, no advertising network, no session-replay tool and no third-party embed on these pages. The application loads its fonts and assets from its own origin.
The pages that talk to a model provider do so from the server, using credentials that never reach your browser — see section 3 of the Privacy Policy.
5. Managing them
- Signing out clears both cookies immediately.
- Your browser's settings let you view and delete cookies and site data for this site. Deleting the session cookies signs you out; deleting local storage resets your preferences.
- Blocking cookies entirely will stop you from signing in — they are the mechanism by which the session exists, not a tracking add-on.
6. Contact
Questions about this notice: [PRIVACY CONTACT EMAIL]. If your organization operates this instance, its administrator can answer for any change it has made to what is stored.