Cookies and similar technologies used by Horara

1. What are cookies and similar technologies

This policy applies to cookies and other equivalent technologies that store or retrieve information from the device, such as localStorage, sessionStorage, service workers, PWA caches, or identifiers associated with third-party scripts.

horara uses these technologies both on the public website and in the private areas of the platform to operate the service, maintain the session, personalize the experience and enable the PWA.

2. Technical or strictly necessary technologies

• Session and Authentication: The platform uses cookies from NextAuth and the session flow itself to identify the authenticated user, maintain access to private areas, enable SSO between Horara applications under their domains, and secure account actions.
• Device restriction: when a company activates device restriction, horara can issue the `horara_device_credential` cookie, of a technical type, and `HttpOnly`, to recognize browsers or PWAs authorized to clock in.
• Theme Preference: `localStorage` is used with the key `horara:theme` to remember if the user prefers light, dark, or system theme.
• Recovery Form Local Limit: Page `/recuperar` uses `localStorage` with the key `horara:password-recovery-attempts` to limit repeated attempts over a short window of time.
• PWA and cache: The app can register a service worker and use browser caches to serve static assets, PWA installation, and technical operation of the app.
• Web push: if the user activates notifications, the browser can store technical information linked to the push subscription and the service worker.

3. Third party services that may use technical storage

• Stripe: When the customer accesses Stripe Checkout or the customer portal, Stripe may use cookies or its own technical storage to process payments, anti-fraud, and maintain session on your domain.
• LinkedIn Insight Tag: If the user accepts marketing cookies, public acquisition pages can load the LinkedIn script to measure campaigns, create audiences, and attribute conversions in Campaign Manager.
• File Storage: If your environment uses Vercel Blob for avatars, uploading and delivering files may involve technical storage and logs associated with the configured provider.

4. Legal basis and preference management

Technical or strictly necessary technologies are used to provide the requested service, maintain the session, apply security controls and enable essential functions of the platform.

The public website preferences panel lets you accept all optional technologies or approve only the necessary ones. If you choose only necessary technologies, LinkedIn Insight Tag remains disabled. Your choice is saved in the browser under the key `horara:marketing-consent`.

You can limit or delete cookies and local storage from your browser or device settings. If you do this, some Horara features may become unavailable or require new configuration, such as sign-in, the PWA, push notifications, or device authorization for clocking in.

5. Conservation

• Session and security cookies are retained as long as necessary to maintain authentication or the corresponding technical function.
• The device restriction technical credential remains valid as long as it is not revoked or the browser data is not deleted.
• Theme preferences and other local storage data are retained until the user deletes them or the application no longer needs them.

6. How to contact us

If you have questions about this policy or about the use of cookies and similar technologies in Horara, you can write to admin@horara.es.

For more general information on the processing of personal data, please also consult the privacy policy.