Effective 5 May 2026
Change your cookie preferences
Re-open the preferences manager to update your choices any time.
This Cookie Policy explains how the TACI Platform uses cookies, localStorage, and other similar storage technologies (collectively “cookies” throughout, in line with EU ePrivacy Directive Article 5(3) terminology) when you use our service.
The platform mostly uses localStorage, which lives in your browser only and is never transmitted with HTTP requests — but ePrivacy treats localStorage as a “similar technology” that requires the same consent rules as traditional cookies. We apply the same rigour.
Strictly necessary for the platform to function. You cannot opt out of these — without them you cannot stay signed in or maintain a project context. We rely on the “strictly necessary” exemption in Article 5(3).
Remember your preferences (CMS choices, website settings, your cookie consent itself). The platform works without these, just less conveniently. You can decline these in the preferences manager.
Currently not in use. We do not run Google Analytics, Hotjar, Segment, Mixpanel or any equivalent. The toggle exists so that if we ever add product analytics, your declared preference applies before any request lands.
Currently not in use. We do not run advertising, retargeting, or third-party marketing trackers. Same forward-compatible reasoning as Analytics.
The complete list of items the platform stores in your browser, plus third-party services that may set their own cookies on their own domains when you interact with them.
| Item | Category | Storage | Duration | Purpose |
|---|---|---|---|---|
| taci_session | Essential | Cookie | 8 hours (sliding, refreshed on activity); cleared on sign-out | Signed session token that authenticates every API call. HttpOnly (JavaScript on this site cannot read it) and SameSite=Lax. Without it you cannot stay signed in. |
| taci_csrf | Essential | Cookie | 8 hours | CSRF double-submit token: the browser stores the same value as a cookie and as a header on every mutating request, so a foreign site cannot forge writes on your behalf. |
| taci_csrf_mirror | Essential | sessionStorage | Session (cleared on tab close) | Per-tab copy of the CSRF token above, used when the frontend and API live on different subdomains (taci.app / api.taci.app) and the browser's cookie is not directly readable by our JavaScript. |
| taci_user | Essential | localStorage | Until sign-out | Cached non-secret profile (user id, name, email, role) so each page render doesn't need a round-trip. No token or password stored here. |
| taci_projects | Essential | localStorage | Until sign-out | Cached list of initiatives you belong to, populates the My Initiatives sidebar. |
| taci_current_project | Essential | localStorage | Until sign-out | Remembers which initiative you have open so the sidebar persists across navigations. |
| taci_entitlements::v2::* | Essential | sessionStorage | Session (cleared on tab close) | Cached plan entitlements (which features your plan includes) keyed by user id, so gated screens don't have to re-fetch the plan on every navigation. |
| taci_checkout_pre_auth_token | Essential | sessionStorage | 15 minutes (server-side TTL); tab close | One-shot token that lets you pay for your plan on the /signup/verify screen without waiting for the email verification code. Tab-scoped and short-lived by design; cleared once verify completes. |
| taci_cookie_consent | Functional | localStorage | 12 months | Records this consent choice plus the policy version and timestamp so we don't re-prompt you on every visit. |
| taci_cms_settings | Functional | localStorage | 12 months | Cached copy of the public site's CMS content (hero copy, gradient, headline) fetched from our API on public-landing and public-feed. Written on every visit for faster paint on the next; contains no personal data. |
| taci_cms_hero_image | Functional | localStorage | 12 months | Cached landing hero image as a base64 data URL, same purpose as above. |
| taci_cms_feed_image | Functional | localStorage | 12 months | Cached feed hero image, same purpose as above for the public feed. |
| taci_theme_overrides | Functional | localStorage | 12 months | Cached copy of the platform theme (accent colours, background images). Superadmin-authored; every visitor gets a copy so the theme paints instantly. |
| taci_initiative_cms_* | Functional | localStorage | 12 months | Per-initiative microsite settings (mission, partner logos, hero) keyed by initiative id. Created when an orchestrator customises a microsite; fallback cache for the public /initiative/[id] page. |
| taci_pending_subscribe_plan | Functional | localStorage | Until sign-up completes | Carries the plan you picked before signing up (e.g. 'professional') across the sign-up → verify → onboarding flow. Cleared once you land on the dashboard. |
| taci_pending_invite_project_id | Functional | localStorage | Until onboarding completes | Bare project UUID from the invitation you're accepting. Lets the onboarding flow route you to that initiative's home instead of the generic dashboard. Cleared as soon as it's consumed on the final onboarding step. |
| taci_just_subscribed_at | Functional | localStorage | 30 minutes | Timestamp used to show a one-time 'You're subscribed' celebration banner on the dashboard right after Stripe redirects back. Auto-expires. |
| taci_invite_org | Functional | sessionStorage | Session (cleared on tab close) | Name of the organisation whose invitation you're accepting, so the signup screens can say 'Join <org>' correctly. Cleared as soon as the invite flow finishes. |
| taci_tips_seen | Functional | localStorage | 12 months | List of first-visit tooltip ids you've dismissed, so we don't re-surface the same tip. |
| taci_first_week_dismissed | Functional | localStorage | 12 months | Records that you dismissed the first-week onboarding checklist, so it stays hidden. |
| taci_welcome_video_watched | Functional | localStorage | 12 months | Records that you watched the welcome video, so the checklist tick stays green after a refresh. |
| taci_user_joined_at | Functional | localStorage | 12 months | Timestamp of your first sign-in on this device, used to decide when the first-week checklist expires. |
| taci_moments_seen | Functional | localStorage | 12 months | Ids of milestone toasts you've already been shown, so the same milestone doesn't trigger the toast twice. |
| taci_maintenance_preview | Functional | Cookie | Session | Operator-only preview bypass — set only when Takko staff opens the site with a maintenance-preview secret in the URL. |
| OpenStreetMap tiles | Functional | Cookie | Set by openstreetmap.org | Map background tiles for the project map (/superadmin/projects). Loaded only when you visit a page that renders the map. OpenStreetMap may set its own cookies. |
| Stripe (Checkout) | Functional | Cookie | Set by stripe.com | When you pay an invoice via Pay-by-card, Stripe's hosted Checkout page sets its own session and fraud-prevention cookies on stripe.com. We never see those cookies. |
We try to keep third-party requests to a minimum. Anything that loads from a domain other than taci.io is listed below.
Outside of the above, the platform is self-contained: fonts are bundled at build time, JavaScript is served from our own origin, and we do not embed third-party widgets, analytics, or marketing tags. No cookies leave the browser to ad networks or trackers.
Use the Manage preferences button at the top of this page (or any “Cookie settings” link) to open the preferences manager. You can change your choice as often as you like; the new choice takes effect immediately.
You can also clear all TACI storage from your browser’s privacy controls. The next time you visit the platform, the consent banner re-appears and you can make a fresh choice.
Your choice is stored in your browser’s localStorage as taci_cookie_consent with a timestamp, the policy version, and the categories you accepted. If you are signed in to TACI, we also record the same information server-side against your user account so our Data Protection Officer can answer the audit question “when did this user consent to functional cookies?” without ambiguity.
If we update this policy in a way that affects you, we bump the version number and re-prompt everyone on next visit. Your previous record is kept on the record.
Questions or complaints about how we handle cookies and storage? Contact our Data Protection Officer at dpo@taci.app. You also have the right to file a complaint with the data-protection authority in your country — for Finnish customers, Tietosuojavaltuutetun toimisto.