Cookie & Session Policy

Last Updated: July 1, 2026

Introduction

This Cookie & Session Policy explains how Prayagh FactoryFlow uses cookies and local browser storage to manage user sessions, ensure system security, and maintain user interface preferences.

Because Prayagh FactoryFlow is a secure internal application, we only use strictly necessary cookies. We do not use any cookies for advertising, marketing, or third-party tracking.

What Are Cookies?

Cookies are small text files stored on your computer or mobile device when you visit a website. They allow the application to remember your actions and secure your logged-in state across different pages.

Cookies We Use

Prayagh FactoryFlow relies entirely on JSON Web Tokens (JWT) for authentication. To protect against Cross-Site Scripting (XSS) attacks, these tokens are never exposed to the frontend JavaScript. Instead, they are securely transmitted via the following cookies:

Cookie Name	Purpose	Duration (TTL)
`ff_access`	The primary Access Token used to verify your identity on every request.	15 Minutes
`ff_refresh`	The Refresh Token used silently in the background to issue a new Access Token without forcing you to log in repeatedly.	7 Days

Security Attributes

Both of the authentication cookies listed above are deployed with the highest security standards:

HttpOnly: They cannot be accessed or stolen by malicious JavaScript (XSS protection).
Secure: They are only transmitted over encrypted HTTPS connections.
SameSite=Strict: They are never sent along with cross-site requests. This acts as our primary defense against Cross-Site Request Forgery (CSRF) attacks.

Session Management & Logout Behavior

Prayagh FactoryFlow operates statelessly. When you successfully log in, the server generates the ff_access and ff_refresh cookies.

When you click Logout, the server actively instructs your browser to delete both cookies, instantly terminating your session. Due to the strict 15-minute expiration on the access token, any stolen or lingering token naturally expires very quickly.

Other Browser Storage (Local Storage)

In addition to cookies, Prayagh FactoryFlow utilizes your browser’s Local Storage mechanism to remember non-sensitive user interface preferences. This data remains on your local machine and is never transmitted to our servers.

factoryflow-ui: Remembers your layout preferences, such as whether you have collapsed or expanded the main sidebar navigation.
theme: Remembers your visual preference between Light Mode, Dark Mode, or System settings.

Analytics & Tracking

Prayagh FactoryFlow is an internal operational tool. We do not use any analytics, tracking, or marketing cookies. There are no third-party integrations designed to monitor your browsing behavior across the web.