Cookie and Local Storage Policy
Every cookie and browser-storage key Lawzer sets, what it does, how long it lasts, and which of them you can refuse.
Drafted against
- Digital Personal Data Protection Act, 2023 — sections 5, 6 and 7
- Information Technology Act, 2000
In short
Lawzer sets one cookie, and it is the one that keeps you signed in. There are no advertising cookies, no third-party trackers, no analytics pixels and no cross-site identifiers, so there is very little here to consent to or refuse. The one cookie that is not ours is Product Hunt's, set by its servers when the badge at the foot of the home page loads.
That is a product decision, not an oversight. A compliance workspace holds one organisation's statutory position, and letting an advertising network observe which filing pages a company secretary visits would be indefensible whatever the consent banner said.
1.The full inventory
| Name | Type | What it does | Lifetime | Can you refuse it? |
|---|---|---|---|---|
| lawzer_session | First-party cookie — httpOnly, SameSite=Lax, Secure in production | Holds the signed session token that identifies you to the server. Without it every page would ask you to sign in again. | 7 days, or until you sign out | No — but it is only set once you choose to sign in. Strictly necessary; section 7(a) of the DPDP Act covers processing for a purpose you have voluntarily engaged. |
| lawzer-theme | localStorage | Remembers whether you chose the light or dark interface, so the page does not flash the wrong one before it loads. | Until you clear it | Yes — the interface falls back to light. Nothing else changes. |
| lawzer-consent | localStorage | Records what you decided in the cookie banner, so you are not asked again. | 12 months | It only exists because you answered the banner. Clearing it makes the banner return. |
| firebase:authUser:… / firebaseLocalStorage | localStorage, set by the Firebase JS SDK | Only present if this deployment has Google sign-in configured and you use it. Holds the Google identity token while it is exchanged for a session. | Until sign-out | Yes — sign in with an email address and password instead. |
| __cf_bm | Third-party cookie, set by Cloudflare for producthunt.com — httpOnly, SameSite=None, Secure | Set by Product Hunt's servers when your browser loads the Product Hunt badge at the foot of the home page. Cloudflare uses it to tell people from bots on Product Hunt. It is Product Hunt's: we cannot read it, and it does not identify you to us. | 30 minutes | Yes — block third-party cookies in your browser. The badge still shows. |
2.Consent, and changing your mind
Strictly necessary storage — the session cookie — is set only when you sign in, and there is no version of the service that works without it. Everything else we set is optional and is not set until you allow it. Product Hunt's cookie is set by Product Hunt when its badge loads, not by us, so the banner cannot hold it back; blocking third-party cookies in your browser does.
The banner has a genuine "Reject" that is as easy to press as "Accept". Section 6(1) of the Digital Personal Data Protection Act, 2023 requires consent to be free, specific, informed, unconditional and unambiguous, and a banner where refusal is buried or styled to be avoided does not meet that. Refusing does not degrade the service, because nothing we would have set was doing anything for you.
You can change the decision at any time from the privacy controls in Settings, or by clearing site data in your browser. Withdrawal is as easy as consent, which section 6(4) requires.
3.Controlling it in your browser
Every major browser lets you block or delete cookies and site data for a specific site, under Settings → Privacy. Blocking cookies for this site will sign you out and prevent you signing back in, because the session cookie is how a signed-in request is recognised.
We honour Global Privacy Control (Sec-GPC) and Do Not Track headers by treating them as a refusal of optional storage. Since we set no advertising or analytics storage in the first place, this makes no practical difference — but a site that ignores the signal is telling you something, and we would rather not.
4.Changes
If we ever add a cookie or a storage key, this table is updated in the same change and the banner asks again where the new item is not strictly necessary. Adding analytics or advertising storage would be a material change to the Privacy Policy and would be notified under section 5(3) of the Act before it happened, not after.