Legal
Cookie Notice
- Version
- 0.1
- Status
- In legal review
- Last updated
- 18 September 2026
In legal review.
Our lawyers are reviewing this notice, including the assessment that no consent banner is required. It may change before it takes effect.
Why you are not looking at a cookie banner
Because we do not set any cookie that requires your consent.
Under the EU ePrivacy rules, consent is needed to store or read information on your device unless it is strictly necessary to provide a service you asked for. Analytics, advertising and cross-site tracking are not strictly necessary. So we do not use them.
Our website analytics are self-hosted and cookieless. They set nothing on your device, create no identifier that follows you between sites, and build no profile. They count page views. The data stays on infrastructure we operate in the EU.
We think a consent banner is a poor trade: it interrupts every visitor in order to permit tracking that mostly benefits the site owner. Not setting the cookies is simpler and more honest than asking permission to set them.
The cookies we do set
All of these are strictly necessary, first-party, and set only on the application domains — never on the marketing site for a logged-out visitor.
| Cookie | Host | Purpose | Type | Lifetime |
|---|---|---|---|---|
__Host-balta_session | app.baltadb.com | Keeps you signed in | Strictly necessary | 30 days, sliding |
__Host-balta_console_session | console.baltadb.com | Keeps staff signed in | Strictly necessary | 8 hours, absolute |
balta_csrf | app and console | Protects against cross-site request forgery | Strictly necessary | Matches the session cookie beside it |
The names are exact, including the __Host- prefix. That prefix is not decoration: a browser
refuses a __Host- cookie unless it is Secure, has Path=/ and carries no Domain attribute, so
the cookie cannot be scoped to a parent domain and shared with another host. Check them against what
your browser shows; if a row here does not match, that is a defect and we want to hear about it.
All are Secure. The two session cookies are HttpOnly and the CSRF cookie deliberately is not,
because the page has to read it and mirror it into a request header, which is the whole mechanism.
The customer cookies are SameSite=Lax and the staff console cookies are SameSite=Strict.
We also use localStorage on the application domains to remember interface preferences such as
whether the sidebar is collapsed and which table columns you have hidden. This never leaves your
browser and contains no personal data.
What we do not use
No Google Analytics. No advertising or retargeting pixels. No social media embeds that phone home. No tag manager. No session recording or heatmaps. No fingerprinting. No cross-site tracking of any kind.
Managing cookies
You can block or delete cookies in your browser settings. Blocking the session cookies will mean you cannot sign in — that is what they are for. Nothing on the marketing site depends on a cookie, so you can browse baltadb.com with cookies fully disabled.
What would change this
If we ever add a service that sets a non-essential cookie — a third-party analytics tool, an advertising pixel, a support widget that tracks across sites — we would have to add a consent banner, and we would update this notice first. If you are reading a version of this page that still says there is no banner and you are looking at one, something has gone wrong and we would like to hear about it: [email protected].
Changes
Every version of this notice is listed at the foot of this page.
Version history
Every version of this document stays available. Where a change materially reduces the commitments in it, account holders are notified by email at least 30 days before it takes effect.
- Version 0.1 · 18 September 2026 · First version, written from our own architecture. In legal review.