'%20stroke='url(%23em)'/%3e%3cellipse%20cx='30'%20cy='34'%20rx='26'%20ry='20'%20fill='url(%23gm)'/%3e%3cpath%20d='M12.5%2013.00L52.5%2021.74L52.5%2024.33L12.5%2017.60Z'%20fill='url(%23lm)'/%3e%3crect%20x='14.20'%20y='19.29'%20width='6.60'%20height='28.93'%20rx='1.45'%20fill='url(%23cm0)'/%3e%3crect%20x='27.00'%20y='21.24'%20width='5.60'%20height='24.81'%20rx='1.23'%20fill='url(%23cm1)'/%3e%3crect%20x='37.60'%20y='22.85'%20width='4.70'%20height='21.42'%20rx='1.03'%20fill='url(%23cm2)'/%3e%3crect%20x='46.60'%20y='24.22'%20width='4.00'%20height='18.53'%20rx='0.88'%20fill='url(%23cm3)'/%3e%3cpath%20d='M12.5%2050.00L52.5%2042.57L52.5%2044.26L12.5%2053.00Z'%20fill='%237fa3ff'%20opacity='.75'/%3e%3c/svg%3e)
PorticolCookie notice
This notice covers this website and the Porticol web client, the interface you use in a browser to sign in and to work in a workspace. It does not cover the desktop application, which stores what it needs on your machine and sends nothing to us unless you sign in.
It takes effect on 21 Oct 2026.
What cookies are
A cookie is a small file a site asks your browser to remember. Some are needed to make a site work at all. Others measure how it is used, and can only be set with your agreement. We set only the first kind.
Cookies we set
This website sets no cookies. The web client sets these, and only these:
| Cookie | What it does | When it expires | Type |
|---|---|---|---|
porticol_session |
Keeps you signed in to the web client | With the session | Strictly necessary |
porticol_oauth |
Holds the state that ties a desktop sign-in to the browser that started it, so another site cannot complete a sign-in in your name, for as long as the sign-in takes | Minutes | Strictly necessary |
porticol_sso |
Holds the binding between a single sign-on request and the reply from your identity provider | Minutes | Strictly necessary |
All three are set with HttpOnly and Secure, so script in the page cannot read them and
none is sent over plain HTTP. porticol_session is SameSite=Strict, so it is not sent
with a request another site makes. porticol_oauth is SameSite=Lax and scoped to
/api/v1/oauth. porticol_sso is SameSite=None, because a SAML response arrives as a
cross-site form post, and it holds only the identifier of the sign-on request itself; it is
scoped to /api/v1/sso. The last two are removed when the flow they belong to finishes.
A session ends after 60 minutes without activity, or after 12 hours in total, whichever comes first. Those are the defaults; an organisation's sign-in policy can set both, and can set them shorter.
Neither this website nor the web client embeds anything from another company's site, so there is no third-party cookie and no cross-site tracking.
What the web client keeps in your browser
The web client keeps your preferences and work in progress in your browser's local storage, which stays in the browser and is not sent to us by itself:
- the tabs you have open, and changes to requests you have not saved yet;
- the service status notices you have dismissed;
- the pairing with the Porticol agent on your computer, once you pair it.
Your theme and density are saved with your account instead, so they follow you to another browser.
No measurement, so no consent banner
We do not measure how this website or the web client is used. Neither runs an analytics tool, an advertising tag or a tracking pixel. Everything above is strictly necessary to give you what you asked for, so we do not ask for your agreement and show no consent banner.
How to control cookies
Your browser can delete cookies and block new ones for this site, and clear what a site keeps in local storage. Blocking the cookies in the table above means you cannot sign in to the web client. Clearing local storage loses unsaved changes and the agent pairing.
Changes
If we add or change a cookie, we change this notice and its date at the top. We give at least 30 days' notice before we set a cookie that is not strictly necessary, and we would ask for your agreement before setting one.
Contact
Questions about this notice: privacy@porticol.app. Postal address: {{PLACEHOLDER:LEGAL_ENTITY_ADDRESS}}. What we do with personal data generally is in the privacy policy.