Cookie Policy
Every cookie Infrality sets, what it does, and why this site does not show you a consent banner.
There is no cookie banner on this site, and that is deliberate. Consent is required for storing or reading information on your device — but not when what is stored is strictly necessary to provide a service you asked for. Everything below is in that category. We run no advertising technology, no third-party trackers, and nothing that follows you to another website. If that ever changes, this page changes first and a banner appears with it.
What we store on your device
| Name | What it does | Lifetime | Why it is exempt |
|---|---|---|---|
| access_token | Keeps you signed in for the length of a session | 15 minutes | Strictly necessary |
| refresh_token | Renews your session without asking you to sign in again | 1 day after a password sign-in, or 30 days if you chose “Keep me signed in”; 7 days after signing in with Google, GitHub or Microsoft, or confirming a new account | Strictly necessary |
| oauth_state | Protects the single sign-on round trip against cross-site request forgery | Minutes — deleted as soon as you return from the provider | Strictly necessary (security) |
| mfa_trusted_device | Remembers this device so you are not asked for a second factor every time | 30 days | Set at your explicit request |
| flash | Carries a one-off message across a redirect, then deletes itself | One page load | Strictly necessary |
All of these are set by infrality.io itself. None is readable by another site, and none is shared with anyone.
Analytics — Plausible, on our own servers
We measure how the website is used with Plausible Analytics, which we run on our own infrastructure in France. It is not a third-party service: no data about your visit leaves our servers.
Plausible does not set a cookie and does not read anything from your device. Instead it:
- derives a signature from your IP address, your browser's user agent and the site's domain, using a salt that is rotated daily and is not stored;
- discards your IP address rather than recording it;
- records the page, the referring site and a country — nothing that identifies you;
- cannot recognise you across sites, or across days.
Because nothing is written to or read from your device, the consent requirement does not apply. Separately, the CNIL exempts audience measurement from consent when it is strictly limited to measuring a site's own traffic, produces only anonymous statistics, is not combined with other processing, is not used to track people across sites, and retains data for no more than 25 months. Our configuration meets each of those conditions. We rely on legitimate interest for this, and you can object to it at [email protected].
Anti-bot verification
Public forms — sign-up, sign-in and the contact form — are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It processes your IP address and browser signals for that check alone, is not used to track you, and does not build an advertising profile. It is strictly necessary to keep the forms usable, and it appears only when you submit.
Controlling this yourself
Your browser can block or delete cookies, and the choice is yours. Blocking ours will sign you out and prevent you signing back in — the session cookie is how the service knows who you are — but nothing else on this site depends on them.
Questions
Anything about this page goes to [email protected]. How we handle personal data more generally is in the Privacy Policy.