Cookies and local storage

Every cookie and browser storage key the TDACorp Identity web app and identityd set, what each is for, how long it lasts and what protects it. This list was read off the code that sets each one.

Last reviewed October 15, 2026

On this page

Draft

This page is pending owner review. TDACorp has not approved it, and it is not yet a statement of TDACorp policy.

Status

Last reviewed 15 October 2026. TDACorp Identity is pre-production. The names, lifetimes and attributes below are quoted from the source files that set them. Each cookie is host-only, so it is sent only to the identity host that set it.

Summary

Question	Answer
How many cookies does the identity host set?	Ten. Eight are essential to signing in. The other two are preferences you set yourself, by choosing a language or an organization
Does the admin console set any?	Two, both encrypted: its session cookie and a short-lived sign-in attempt cookie
Are any set by a third party?	No. All are first party
Are there analytics, advertising or tracking cookies?	No. None is set by any code in the identity web app, identityd or the admin console
Does the platform use `localStorage`, `sessionStorage` or IndexedDB?	No. A search of the web app, admin console and UI package finds no use of any of them
Does it use `document.cookie`?	Once: the language switcher on the sign-in pages writes its own cookie from the browser when you pick a language. Every other cookie is set by the server and is `HttpOnly`, so no script can read it
Is a cookie banner shown?	No. The only cookies that are not essential to signing in are the language preference and the remembered organization, which you set yourself by choosing a language or switching organization. The basis is described below

Cookies set by the identity host

All ten carry the __Host- prefix. That prefix is enforced by the browser: the cookie must be Secure, must have Path=/, and must not carry a Domain attribute, so it cannot be set over plain HTTP or scoped to a parent domain. All ten are SameSite=Lax. Nine are HttpOnly. The language cookie is not, because the browser writes it when you pick a language.

Name	Purpose	Party	Duration	Attributes	Essential
__Host-tdaid_sid	Keeps you signed in. The value is a session secret. Only a SHA-256 digest of it is stored	First	`Max-Age` equal to the session's absolute lifetime, 14 days by default. The session also ends after 12 hours idle	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes
__Host-tdaid_ltx	Tracks a sign-in in progress. Holds only the login transaction id. A magic link or email code works only in the browser that holds it	First	10 minutes (600 seconds)	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes
__Host-device_id	Lets the account recognise a browser it has seen before and show you your devices. A random 32-byte value, not personal data. Only a hash is stored	First	400 days	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes, for new-browser detection and the devices list
__Host-tdaid_rdev	Set only when you start account recovery, so a recovery link opens only in the browser that asked for it	First	30 days	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes, during recovery
__Host-tdaid_regb	Registration binding. Set on every registration request, whether or not the address already has an account, so setting it reveals nothing. A resend request reads it and does not set it. Holds a random 32-byte value. Its hash is stored beside the mailed code, so an 8-digit code typed anywhere else matches nothing	First	30 minutes	`Path=/; HttpOnly; Secure; SameSite=Lax`	Yes, during registration
__Host-tdaid_regv	Registration verified link. Set once a link or code has been checked, and carries that link's secret so the passkey and password steps need no secret in a request body	First	15 minutes. The emailed link itself is valid for 24 hours	`Path=/; HttpOnly; Secure; SameSite=Lax`	Yes, during registration
__Host-tdaid_fed	Federated sign-in or account-link state. Holds a signed payload: version, provider id, mode, transaction or session ids, expiry and random bytes. Nothing in it is secret from the browser that holds it, and it cannot be forged without the server key	First	10 minutes (600 seconds)	`Path=/; HttpOnly; Secure; SameSite=Lax`	Yes, only if you choose federated sign-in
__Host-tdaid_pk_offer	Remembers that you skipped the optional passkey offer, so you are not asked again for 7 days. Holds the value 1	First	7 days	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes, for the passkey offer
__Host-tdaid_org	Remembers the organization you last switched to in your account, on this browser, so your next visit opens it by default. The value is the organization's id. It is only a hint: it is re-checked against your active memberships every time and grants nothing. Only identity reads it. It is set by the server only after you successfully switch organization in your account, never on a plain sign-in and never by your browser's script	First	365 days by default (`Max-Age` 31536000). The setting `account.last_org_cookie_max_age_s` adjusts it, from 1 day up to a maximum of 400	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	No, a convenience preference. Without it the account opens your personal workspace or your first organization
__Host-tdaid_lang	Remembers the language you chose with the language switcher on the sign-in pages: one of `en`, `fr` or `es` and nothing else. It is written by your browser, only when you pick a language. A language saved in your profile, and the `ui_locales` of an application that sent you here, are used before it	First	1 year (`Max-Age` 31536000)	`Path=/; Secure; SameSite=Lax`, no Domain, not `HttpOnly`	No, functional. Without it the pages follow your browser's language list, then English

Detail	Value
Cookie lifetime	The session's absolute expiry, never below 1 second. The browser stops sending it at that time
Server-side idle limit	12 hours
Server-side absolute limit	14 days
Longer sessions	A "keep me signed in" option exists in code behind a feature flag. It is not enabled in the production configuration
Revocation	Every account request looks the session up in the database. Revoking a session or deactivating an account takes effect on the next request
Clearing	Signing out sends the same cookie with `Max-Age=0` and the same attributes

Moment	Cookies set or read
Visiting a public page such as this one	None
Starting to sign in	`__Host-tdaid_ltx`
Completing sign in	`__Host-tdaid_sid` and `__Host-device_id` set. `__Host-tdaid_ltx` cleared
Registering	`__Host-tdaid_regb`, then `__Host-tdaid_regv`
Starting account recovery	`__Host-tdaid_rdev`
Choosing Google or GitHub sign-in (if offered)	`__Host-tdaid_fed`
Skipping the optional passkey offer during sign-in	`__Host-tdaid_pk_offer`
Picking a language with the switcher on a sign-in page	`__Host-tdaid_lang` set, by the browser
Switching organization in your account	`__Host-tdaid_org` set
Signing out	`__Host-tdaid_sid` and `__Host-tdaid_org` cleared

Cookies set by the admin console

The admin console is a separate Next.js application that signs in through identityd over OpenID Connect. It keeps its own session.

Name	Purpose	Party	Duration	Attributes	Essential
__Host-tdaid_admin_session	The console's own session: encrypted tokens obtained from the sign-in, a few ID-token claims, and a flag showing a break-glass session. The cookie value is an encrypted token	First	7 days (`Max-Age` 604800)	`Path=/; HttpOnly; Secure; SameSite=Lax`, no Domain	Yes, for operators only
tdaid_admin_login_attempt	State of an administrator sign-in in progress: a one-time code verifier, state and nonce for the redirect to identityd, and where to return to. Cleared when the sign-in completes or is refused	First	10 minutes (`Max-Age` 600)	`Path=/; HttpOnly; SameSite=Lax`, `Secure` in production, no `__Host-` prefix, encrypted value	Yes, for operators only

In local development over plain HTTP the session cookie is named tdaid_admin_session without the prefix and without Secure, because a browser refuses a Secure cookie there. That variant is never used in production builds.

Browser storage

Store	Used	Detail
`localStorage`	No	No code in the web app, admin console or UI package reads or writes it
`sessionStorage`	No	No use found
IndexedDB	No	No use found
Service workers	No	None registered: no use found in the code
Cache headers	Not storage	Responses without an explicit `Cache-Control` are `no-store`
`document.cookie`	Once	Only the language switcher uses it, to write `__Host-tdaid_lang` when you pick a language. Every other cookie is set by the server
Theme and language preferences	Language only	The theme is not stored. The language is the `__Host-tdaid_lang` cookie above, set only when you pick one. Your language saved in your account profile is stored on the server, not in the browser

What is not used

Not used	Basis for the statement
Analytics cookies or scripts	No analytics or third-party script is loaded on any page served by this platform. The pages are served with a content security policy that allows only this site's own scripts and styles
Advertising or tracking cookies	None exist in the code. There is no such feature to opt out of
Third-party cookies	No third-party content is loaded. The pages load no third-party scripts, fonts or images
Device recognition beyond the listed cookie	The only device cookie is the random `__Host-device_id` value. Sessions also record a hash of the user-agent and the network address, as described in the privacy policy
A separate CSRF cookie	None. Protection is `SameSite=Lax` plus a same-origin check on every request that changes state

Consent basis

Item	Position
Basis	Eight of the ten cookies are strictly necessary to deliver the sign-in, recovery, registration and session functions that a person has asked for. They are set in response to your own actions. The other two, `__Host-tdaid_lang` and `__Host-tdaid_org`, are preferences: each is set only when you pick a language or switch organization, and each only keeps that choice
Consent prompt	None is shown. The only cookies that are not essential to signing in are each set by your own explicit choice of a language or an organization
What the platform asks for at registration	A consent notice for the account itself, described in the privacy policy. That is consent to the account and its processing, not to cookies
Legal characterisation	Whether strictly necessary cookies need consent under any particular law is a legal question that this page does not answer

Note

Pending legal review by the owner: the legal basis wording for cookies.

How to manage cookies

Goal	How
End your session	Sign out from the account menu. The session cookie is cleared and the session is revoked on the server
End every other session	Open Sessions in your account and revoke them individually or all at once
Make the account forget a browser	Remove the device from the Devices list in your account. The `__Host-device_id` cookie in that browser then no longer matches a device, though the browser may keep the cookie until it expires
Clear cookies in your browser	Use your browser's settings. Clearing the session cookie signs you out of the browser. Clearing `__Host-device_id` makes the next sign-in look like a new browser, which sends a new-sign-in alert email
Forget your remembered organization	Clear `__Host-tdaid_org` in your browser settings, or switch organization again. The account then opens your personal workspace or your first organization
Forget your language choice	Clear `__Host-tdaid_lang` in your browser settings, or pick the language again. The pages then follow your account language, an application's request, or your browser's language list
Block cookies	Sign-in will not work, because the login transaction and session cannot be held. There is no cookie-free mode

What this page does not claim

Not claimed	Detail
A complete picture of every TDACorp site	This covers the identity web app, identityd and the admin console. The marketing website tdacorp.in has its own policy
Cookies set by products that sign you in	A product built on this platform sets its own cookies. They are not listed here
That no cookie will ever be added	The list is read from the code on the review date. A change in code changes the list, and this page is updated when the copy is reviewed
A legal opinion on consent	The consent basis above describes how the platform behaves. It is not legal advice
A cookie banner or preference centre	None exists. The language switcher and the organization switcher are the two preferences, and each writes its cookie only when you use it
Third-party cookies from federation providers	If Google or GitHub sign-in is ever offered, the provider's own cookies on its own domain are outside this platform's control