Cookies
The complete list of the cookies and browser storage this site uses, what each is for and how long it lasts.
This text was drafted from what the software actually does and has not yet been reviewed by a lawyer. Highlighted [to confirm: items] are facts or choices still open; nothing here claims a certification or a compliance status we do not have.
Every cookie and storage key we use
These apply on both the public site (bistroresearch.com) and the control center (app.bistroresearch.com). All are first-party: set by us, not by anyone else. There are no third-party cookies on our pages.
Strictly necessary (no consent needed)
sessionid
Keeps you signed in. It also holds the temporary state of a Google or Microsoft sign-in while it is in progress.
- Type
- Cookie · first-party
- Set by
- our server (Django)
- Lasts
- 14 days
- Detail
- HttpOnly, Secure, SameSite=Lax, domain .bistroresearch.com. Set when you sign in or start a provider sign-in; reading the site never sets it.
csrftoken
Security: stops another website from submitting a form in your name.
- Type
- Cookie · first-party
- Set by
- our server (Django)
- Lasts
- about 1 year
- Detail
- Secure, SameSite=Lax, domain .bistroresearch.com. Set on your first page load because the page asks the server who you are; a script copies it into a request header.
bistro-consent
Remembers your cookie choice, the date you made it and the version of this list it applies to.
- Type
- Cookie · first-party
- Set by
- this site (your browser)
- Lasts
- 12 months
- Detail
- Secure, SameSite=Lax, domain .bistroresearch.com so one choice covers the public site and the control center. Holds no identifier.
Optional: Remember form drafts (off until you allow it)
bistro-draft:proposal, bistro-draft:maintainer, bistro-draft:organisation
Keeps the text you typed in a proposal, maintainer application or inquiry form on this device, so a closed tab or a sign-in round trip does not lose it.
- Type
- Browser storage (localStorage), never sent to us · first-party
- Set by
- this site (your browser)
- Lasts
- until the form is sent or you clear it
- Detail
- Never sent to us until you send the form. Written while you type only if you allowed “Remember form drafts”. Written regardless at the moment you press Send before signing in, because the sign-in sends you away from the page and you asked to send.
Why the necessary ones need no consent
EU and UK rules (ePrivacy Directive art. 5(3), PECR reg. 6) require consent before storing or reading anything on your device unless it is strictly necessary to provide something you asked for or to keep the service secure. The session cookie keeps you signed in, the security token blocks forged form submissions, and the choice cookie is how we remember that you said no. We list them here so nothing is hidden.
Optional storage and your choice
Optional storage stays off until you say yes. “Accept all”, “Reject all” and “Choose” have the same size and weight on purpose. You can change your mind at any time with Cookie settings (in the footer of the public site, and in Settings → Legal in the control center); saying no again also deletes what was kept. We ask again once a year, and whenever this list changes.
Your choice is stored in the bistro-consent cookie with its date and the version of this list. moiseev.igor@gmail.com if something here is wrong.
Browser privacy signals
If your browser sends Global Privacy Control, or Do Not Track set to 1, we read it as “no optional storage”, record that as your choice without showing a banner, and leave it to you to change in Cookie settings. It does not change the necessary cookies above.
Other sites you may go to
Some actions hand you to another company's site, which sets its own cookies under its own policy. We do not control them and cannot list them.
What we do not use
No advertising, tracking, analytics or social-media cookies or scripts; no fingerprinting; no third-party fonts loaded from your browser (fonts are served from our own address). If that ever changes, it will be listed above, it will be off until you allow it, and everyone will be asked again.