Cookie and Local Storage Policy
Every cookie and browser-storage key Lawzer sets, what it does, how long it lasts, and which of them you can refuse.
Drafted against
- Digital Personal Data Protection Act, 2023 — sections 5, 6 and 7
- Information Technology Act, 2000
In short
Lawzer sets one cookie, and it is the one that keeps you signed in. There are no advertising cookies, no third-party trackers, no analytics pixels and no cross-site identifiers, so there is very little here to consent to or refuse.
That is a product decision, not an oversight. A compliance workspace holds one organisation's statutory position, and letting an advertising network observe which filing pages a company secretary visits would be indefensible whatever the consent banner said.
1.The full inventory
| Name | Type | What it does | Lifetime | Can you refuse it? |
|---|---|---|---|---|
| lawzer_session | First-party cookie — httpOnly, SameSite=Lax, Secure in production | Holds the signed session token that identifies you to the server. Without it every page would ask you to sign in again. | 7 days, or until you sign out | No — but it is only set once you choose to sign in. Strictly necessary; section 7(a) of the DPDP Act covers processing for a purpose you have voluntarily engaged. |
| lawzer-theme | localStorage | Remembers whether you chose the light or dark interface, so the page does not flash the wrong one before it loads. | Until you clear it | Yes — the interface falls back to light. Nothing else changes. |
| lawzer-consent | localStorage | Records what you decided in the cookie banner, so you are not asked again. | 12 months | It only exists because you answered the banner. Clearing it makes the banner return. |
| firebase:authUser:… / firebaseLocalStorage | localStorage, set by the Firebase JS SDK | Only present if this deployment has Google sign-in configured and you use it. Holds the Google identity token while it is exchanged for a session. | Until sign-out | Yes — sign in with an email address and password instead. |
2.Consent, and changing your mind
Strictly necessary storage — the session cookie — is set only when you sign in, and there is no version of the service that works without it. Everything else is optional and is not set until you allow it.
The banner has a genuine "Reject" that is as easy to press as "Accept". Section 6(1) of the Digital Personal Data Protection Act, 2023 requires consent to be free, specific, informed, unconditional and unambiguous, and a banner where refusal is buried or styled to be avoided does not meet that. Refusing does not degrade the service, because nothing we would have set was doing anything for you.
You can change the decision at any time from the privacy controls in Settings, or by clearing site data in your browser. Withdrawal is as easy as consent, which section 6(4) requires.
3.Controlling it in your browser
Every major browser lets you block or delete cookies and site data for a specific site, under Settings → Privacy. Blocking cookies for this site will sign you out and prevent you signing back in, because the session cookie is how a signed-in request is recognised.
We honour Global Privacy Control (Sec-GPC) and Do Not Track headers by treating them as a refusal of optional storage. Since we set no advertising or analytics storage in the first place, this makes no practical difference — but a site that ignores the signal is telling you something, and we would rather not.
4.Changes
If we ever add a cookie or a storage key, this table is updated in the same change and the banner asks again where the new item is not strictly necessary. Adding analytics or advertising storage would be a material change to the Privacy Policy and would be notified under section 5(3) of the Act before it happened, not after.