Legal · Version 1.0

Cookie Policy

Effective 5 May 2026

Change your cookie preferences

Re-open the preferences manager to update your choices any time.

This Cookie Policy explains how the TACI Platform uses cookies, localStorage, and other similar storage technologies (collectively “cookies” throughout, in line with EU ePrivacy Directive Article 5(3) terminology) when you use our service.

The platform mostly uses localStorage, which lives in your browser only and is never transmitted with HTTP requests — but ePrivacy treats localStorage as a “similar technology” that requires the same consent rules as traditional cookies. We apply the same rigour.

1. The four categories

Essential

Strictly necessary for the platform to function. You cannot opt out of these — without them you cannot stay signed in or maintain a project context. We rely on the “strictly necessary” exemption in Article 5(3).

Functional

Remember your preferences (CMS choices, website settings, your cookie consent itself). The platform works without these, just less conveniently. You can decline these in the preferences manager.

Analytics

Currently not in use. We do not run Google Analytics, Hotjar, Segment, Mixpanel or any equivalent. The toggle exists so that if we ever add product analytics, your declared preference applies before any request lands.

Marketing

Currently not in use. We do not run advertising, retargeting, or third-party marketing trackers. Same forward-compatible reasoning as Analytics.

2. What we actually store — full inventory

The complete list of items the platform stores in your browser, plus third-party services that may set their own cookies on their own domains when you interact with them.

ItemCategoryStorageDurationPurpose
taci_sessionEssentialCookie8 hours (sliding, refreshed on activity); cleared on sign-outSigned session token that authenticates every API call. HttpOnly (JavaScript on this site cannot read it) and SameSite=Lax. Without it you cannot stay signed in.
taci_csrfEssentialCookie8 hoursCSRF double-submit token: the browser stores the same value as a cookie and as a header on every mutating request, so a foreign site cannot forge writes on your behalf.
taci_csrf_mirrorEssentialsessionStorageSession (cleared on tab close)Per-tab copy of the CSRF token above, used when the frontend and API live on different subdomains (taci.app / api.taci.app) and the browser's cookie is not directly readable by our JavaScript.
taci_userEssentiallocalStorageUntil sign-outCached non-secret profile (user id, name, email, role) so each page render doesn't need a round-trip. No token or password stored here.
taci_projectsEssentiallocalStorageUntil sign-outCached list of initiatives you belong to, populates the My Initiatives sidebar.
taci_current_projectEssentiallocalStorageUntil sign-outRemembers which initiative you have open so the sidebar persists across navigations.
taci_entitlements::v2::*EssentialsessionStorageSession (cleared on tab close)Cached plan entitlements (which features your plan includes) keyed by user id, so gated screens don't have to re-fetch the plan on every navigation.
taci_checkout_pre_auth_tokenEssentialsessionStorage15 minutes (server-side TTL); tab closeOne-shot token that lets you pay for your plan on the /signup/verify screen without waiting for the email verification code. Tab-scoped and short-lived by design; cleared once verify completes.
taci_cookie_consentFunctionallocalStorage12 monthsRecords this consent choice plus the policy version and timestamp so we don't re-prompt you on every visit.
taci_cms_settingsFunctionallocalStorage12 monthsCached copy of the public site's CMS content (hero copy, gradient, headline) fetched from our API on public-landing and public-feed. Written on every visit for faster paint on the next; contains no personal data.
taci_cms_hero_imageFunctionallocalStorage12 monthsCached landing hero image as a base64 data URL, same purpose as above.
taci_cms_feed_imageFunctionallocalStorage12 monthsCached feed hero image, same purpose as above for the public feed.
taci_theme_overridesFunctionallocalStorage12 monthsCached copy of the platform theme (accent colours, background images). Superadmin-authored; every visitor gets a copy so the theme paints instantly.
taci_initiative_cms_*FunctionallocalStorage12 monthsPer-initiative microsite settings (mission, partner logos, hero) keyed by initiative id. Created when an orchestrator customises a microsite; fallback cache for the public /initiative/[id] page.
taci_pending_subscribe_planFunctionallocalStorageUntil sign-up completesCarries the plan you picked before signing up (e.g. 'professional') across the sign-up → verify → onboarding flow. Cleared once you land on the dashboard.
taci_pending_invite_project_idFunctionallocalStorageUntil onboarding completesBare project UUID from the invitation you're accepting. Lets the onboarding flow route you to that initiative's home instead of the generic dashboard. Cleared as soon as it's consumed on the final onboarding step.
taci_just_subscribed_atFunctionallocalStorage30 minutesTimestamp used to show a one-time 'You're subscribed' celebration banner on the dashboard right after Stripe redirects back. Auto-expires.
taci_invite_orgFunctionalsessionStorageSession (cleared on tab close)Name of the organisation whose invitation you're accepting, so the signup screens can say 'Join <org>' correctly. Cleared as soon as the invite flow finishes.
taci_tips_seenFunctionallocalStorage12 monthsList of first-visit tooltip ids you've dismissed, so we don't re-surface the same tip.
taci_first_week_dismissedFunctionallocalStorage12 monthsRecords that you dismissed the first-week onboarding checklist, so it stays hidden.
taci_welcome_video_watchedFunctionallocalStorage12 monthsRecords that you watched the welcome video, so the checklist tick stays green after a refresh.
taci_user_joined_atFunctionallocalStorage12 monthsTimestamp of your first sign-in on this device, used to decide when the first-week checklist expires.
taci_moments_seenFunctionallocalStorage12 monthsIds of milestone toasts you've already been shown, so the same milestone doesn't trigger the toast twice.
taci_maintenance_previewFunctionalCookieSessionOperator-only preview bypass — set only when Takko staff opens the site with a maintenance-preview secret in the URL.
OpenStreetMap tilesFunctionalCookieSet by openstreetmap.orgMap background tiles for the project map (/superadmin/projects). Loaded only when you visit a page that renders the map. OpenStreetMap may set its own cookies.
Stripe (Checkout)FunctionalCookieSet by stripe.comWhen you pay an invoice via Pay-by-card, Stripe's hosted Checkout page sets its own session and fraud-prevention cookies on stripe.com. We never see those cookies.

3. Third-party services

We try to keep third-party requests to a minimum. Anything that loads from a domain other than taci.io is listed below.

Outside of the above, the platform is self-contained: fonts are bundled at build time, JavaScript is served from our own origin, and we do not embed third-party widgets, analytics, or marketing tags. No cookies leave the browser to ad networks or trackers.

4. How to manage your preferences

Use the Manage preferences button at the top of this page (or any “Cookie settings” link) to open the preferences manager. You can change your choice as often as you like; the new choice takes effect immediately.

You can also clear all TACI storage from your browser’s privacy controls. The next time you visit the platform, the consent banner re-appears and you can make a fresh choice.

5. Where your consent is recorded

Your choice is stored in your browser’s localStorage as taci_cookie_consent with a timestamp, the policy version, and the categories you accepted. If you are signed in to TACI, we also record the same information server-side against your user account so our Data Protection Officer can answer the audit question “when did this user consent to functional cookies?” without ambiguity.

If we update this policy in a way that affects you, we bump the version number and re-prompt everyone on next visit. Your previous record is kept on the record.

6. Contact

Questions or complaints about how we handle cookies and storage? Contact our Data Protection Officer at dpo@taci.app. You also have the right to file a complaint with the data-protection authority in your country — for Finnish customers, Tietosuojavaltuutetun toimisto.

See also: Privacy Policy · Terms of Service · Data Processing Agreement