Cookies and Local Storage Notice

Version 1.11 — effective 28 October 2026

Scope

This notice explains browser technologies used by IMORAY. The operator is SYNRADX TECHNOLOGIES S.R.L., identified in the Legal Notice. Questions may be sent to privacy@imoray.app.

The current version does not use advertising cookies, profiling, session replay or marketing analytics. The cookies and storage below are needed for authentication, security, operation, recovery and user-requested preferences.

Strictly necessary cookies

• imoray_session — opaque authenticated-session token; HttpOnly, SameSite Lax and Secure over HTTPS; default duration 30 days and deleted on logout or expiry. The server stores only the token hash.
• imoray_legal_access — signed evidence that the applicable legal release was accepted; HttpOnly, SameSite Lax and Secure in production; up to 30 days or until the version changes.
• imoray_passkey_challenge — opaque, single-use token strictly needed to bind the browser to a passkey registration or authentication ceremony; HttpOnly, SameSite Strict, Secure over HTTPS and valid for at most 5 minutes. The challenge, ceremony kind, expiry and, for registration, internal user identifier are held server-side; the cookie does not contain the private key or passkey credential and is deleted after consumption or when an invalid ceremony is detected.
• imoray_device_id — random browser identifier for device limits, session revocation and security; up to one year and deleted on logout and associated account cleanup.
• imoray_google_oauth_state — CSRF protection and local return destination for Google sign-in, when enabled; expires after 10 minutes and is deleted by the callback.
• imoray-ui-locale — chosen interface language; SameSite Lax, Secure over HTTPS, 1 year.

Legacy keys may be read temporarily only for migration and deletion; the application no longer creates them.

Preferences and localStorage operation

Until changed or cleared, the browser stores preferences such as theme, interface language, report language and style, dictation key, panels, layout, onboarding and visual highlighting.

Acceptance of the patient-data warning may be remembered on the browser until logout, account cleanup or browser-data deletion. Cancelling an action is never remembered as acceptance.

On sign-in, radiology-demo-session stores a local copy of the demo identity: name, email address, optional organisation, pseudonymous user identifier, device identifier, creation time and expiry. The copy expires 14 days after creation and is removed when read after expiry or on logout/account cleanup. radiology-demo-device separately stores the pseudonymous browser UUID used in that copy; no independent expiry is observed and it remains until account or browser-data cleanup. These keys do not replace the HttpOnly authenticated-session cookie and contain no password, authentication token or clinical content.

Working content in localStorage

For recovery and requested features there may be:

• the active workspace snapshot, overwritten during work and removed by Reset, logout, cleanup or disallowed-input detection;
• reports explicitly saved by the user, capped by default at 100 and pruned after 90 days;
• personal templates and style preferences, synchronised with the account where available;
• up to 250 local technical-usage events and up to 200 feedback or template entries;
• interface preferences that remain on the device after logout where they are not account content.

This data, including the demo copy of name/email/organisation and the device identifier, is accessible to other people or extensions with access to the same browser profile. Use a secured profile, protect the device, do not leave a session open on a shared device and clear browser data when the device is no longer under your control.

Audio recordings in IndexedDB

If transcription fails or there is no connection, the original recording may be held locally for an explicit retry. The IndexedDB queue imoray-local-clinical-queue-v1 stores at most three recordings and 50 MiB in total for the user. Each recording expires after 24 hours. The queue is deleted on logout or browser account cleanup.

Files remain on the user's device; the application does not claim that the browser separately encrypts them. Their protection also depends on the operating system, browser profile and device controls.

sessionStorage and technologies not currently used

During the current tab session, sessionStorage may temporarily hold:

• the minimum context needed to return from Stripe Checkout and avoid a duplicate payment: order type, plan, currency, total and technical session/order/attempt identifiers together with creation time; email, card data and clinical content are not stored there; entries logically expire after at most 24 hours and are removed when invalid or after flow reconciliation;
• the application release identifier for which the update notice was acknowledged during that tab session.

sessionStorage is limited to the page session and may be cleared when the tab is closed or browser data is cleared. The application does not use Service Worker or Cache Storage. Pathology Summary results are private no-store responses and are not written by the application to workspace, history or shared cache.

Third-party providers

Google OAuth and Stripe-hosted pages, when opened, may use their own cookies on their domains. Those technologies are controlled and described by the provider. IMORAY does not ordinarily load third-party marketing tags in the workspace.

User choice

Because the current version uses only strictly necessary technologies or requested preferences, no marketing-consent banner is shown. If we introduce non-essential analytics, advertising or session replay, it will remain off until notice, a valid choice and withdrawal are available where required by law.

You may clear cookies and storage in browser settings. Blocking strictly necessary technologies may prevent sign-in, security, audio recovery and workspace operation.

Changes

We update this notice when technologies, purposes or durations change. A new non-essential technology will first undergo the required legal and technical control.