Cookie Policy

"DataJewellers" means Data Doodles Tech Private Limited, the operator of the DataJewellers service ("we", "us"). This policy explains every cookie DataJewellers sets, and everything else it stores in your browser or on your device.

1. What this policy covers

This policy applies to datajewellers.com, the business sign-in portal at business.datajewellers.com, each business's own workspace address, the demonstration workspace at demo.datajewellers.com, and the operator console at superadmin.datajewellers.com. Read it alongside our Privacy Policy and the Mobile & Desktop App Terms.

2. The two cookies we set

DataJewellers sets exactly two cookies. Both exist to keep a signed-in session going. There are no others.

2.1 The workspace session cookie

Set when you sign in to a business workspace. It holds a signed session token — never your password, and never your business data — so each page you open is recognised as yours.

2.2 The console session cookie

Set only when a DataJewellers platform operator signs in to the operator console at superadmin.datajewellers.com. It never reaches a business's workspace, and an ordinary user of the product will never receive it.

2.3 What both cookies do, in plain words

• Not readable by scripts. They are marked httpOnly, so code running in the page cannot read them. This limits the damage a scripting attack could do.
• Sent only over an encrypted connection. On our live deployments they are marked secure, so your browser will only send them over HTTPS.
• Not sent from other websites. They are marked same-site strict, so another site cannot make your browser send them — one of the controls that prevents cross-site request forgery.
• Short-lived. The workspace session cookie lasts 12 hours; the console session cookie lasts 8 hours. A time-boxed support session issued to our staff is shorter still, at one hour.
• Cleared on sign-out. Signing out removes the cookie and, on our side, invalidates the session token so it cannot be reused even if it were captured.

Both fall into a single category: strictly necessary — authentication and security. Neither profiles you, follows you between websites, or feeds any advertising or measurement system.

3. Why you do not see a cookie banner

Consent mechanisms exist for cookies that are not necessary to deliver a service you asked for — analytics, advertising, and cross-site tracking. DataJewellers uses none of those. Because only strictly necessary authentication cookies are set, no consent mechanism is required, so none is shown. We think a banner asking permission for cookies we do not use would be misleading rather than helpful.

If that ever changes — if we introduce any cookie that is not strictly necessary — we will update this policy and put the appropriate consent mechanism in place on the site before the new cookie is set, not afterwards.

4. What the product stores on your device

The following is browser storage, not cookies. It stays on your device unless you or the product sends something specific to the server.

• Offline point-of-sale cache and outbox. The workspace keeps a local database (IndexedDB) for each combination of workspace address and signed-in user. It holds a working copy of item and customer records so billing keeps working when the connection drops, plus an outbox of offline sales waiting to sync. The Data Retention & Deletion Policy explains what happens to that copy.
• Small local preferences. A handful of values in local storage remember how you like the interface (for example, whether the sidebar is collapsed), keep a local counter used to number printed reports, remember which workspaces you have recently opened, and hold a generated device identifier and the last signed-in user so offline sales can be attributed to the right device when they sync. These values are set by the application, not by any third party.
• The offline app shell. A service worker stores the application's own files — its code, styles and icons — so the workspace can open when the network is unavailable. It never caches API responses, so your business data is not held in that cache.

5. What we do not use

We use no analytics cookies, no marketing or advertising cookies, no tracking pixels, no cross-site identifiers, no session recording, and no third-party cookies. The product loads no third-party scripts, fonts or tag managers, so no other company is in a position to set a cookie through it.

6. Clearing cookies and stored data

Signing out clears the session cookie. Beyond that, every current browser lets you delete cookies and site data for one site, or block them entirely, from its privacy settings. Removing the desktop application's data has the same effect.

Note what this costs you: blocking or deleting our session cookie will sign you out and prevent you from signing back in, because the cookie is the session. Clearing browser storage will also discard any offline sales still sitting in the outbox that have not yet synced, so let the workspace finish syncing first.

7. Changes to this policy

If what we set or store changes, we publish a new version of this policy. Earlier versions stay available from this page.

8. Contact

Questions about this policy: support@datadoodlestech.com. For anything else, see the Legal & Compliance Contact page.