Cookie & Local Storage Policy

Effective date: 24 June 2026

Trefnus Training does not use tracking or advertising cookies. It uses your browser's local storage technologies purely to make the application work — to keep you signed in, to secure access, to store your training data on your Device, and to enable offline use. This policy lists every storage item it uses.

1. Technologies We Use

localStorage — persistent key/value storage on your Device used for your training data, licence state, security material and preferences. It persists until cleared.
IndexedDB — a structured on-device database used to store a reference (handle) to an optional Backup Folder you nominate, which cannot be stored in localStorage.
Service Worker Cache (Cache Storage) — stores the application's files so it loads quickly and works offline.
Third-party authentication storage — our authentication provider's client library may store a session token in localStorage (keys beginning sb-) so you remain signed in to verify your licence.

We do not set any traditional HTTP cookies of our own for tracking, analytics or advertising.

2. Detailed Storage Breakdown

2.1 localStorage — application data & preferences

Key	Purpose	Duration
`trefnus_training_v1`	Your entire training dataset (employees, certification types, training records, packages, providers, notifications and app settings)	Until you delete it or clear browser storage
`app_training_legal_acceptance`	Records that you accepted the legal policies and the date/time of acceptance	Persistent

2.2 localStorage — licence & activation

Key	Purpose	Duration
`app_training_licence_activated`	Flag indicating this Device has an activated licence	Until deactivated or storage cleared
`app_training_licence_user_id`	Your account identifier, to associate the Device with your licence	Until deactivated or storage cleared
`app_training_licence_activated_at`	Timestamp of first activation on this Device	Until deactivated or storage cleared
`app_training_last_verified`	Timestamp of the last successful licence verification (enables a temporary offline grace period)	Until deactivated or storage cleared
`app_training_device_hash`	A randomly generated identifier for this Device (a UUID), used to enforce the device limit	Persistent on this Device

2.3 localStorage — local security (password gate)

Key	Purpose	Duration
`app_training_pwd_hash`	A salted PBKDF2 hash of your local password (the password itself is never stored)	Until reset or storage cleared
`app_training_remember_until`	Expiry time for the "remember this device for 30 days" option, so you are not prompted for the password on every launch	Up to 30 days

2.4 localStorage — backup reminder (set only if you use a Backup Folder)

Key	Purpose	Duration
`trefnus_training_backup_*` (snooze state)	Remembers when you snoozed the "back up your data" reminder banner	Until the snooze period elapses

2.5 localStorage — third-party authentication

Key	Purpose	Duration
`sb-*` (set by our auth provider's library)	Stores your authentication session/token so your licence can be verified without repeated sign-in	Until the session expires or you sign out

2.6 IndexedDB

Database / Store	Purpose	Duration
`trefnus_training_backup` → store `handles` (key `backupDir`)	Stores a reference (FileSystemDirectoryHandle) to the folder you nominated for backups, so the app can write backups there without asking each time	Until you remove it or clear browser storage

2.7 Service Worker Cache

Cache	Purpose	Duration
`trefnus-training-v<n>`	Caches the application shell and assets (HTML, scripts, icons, legal pages and the auth library) for fast loading and offline use	Until a new version is released or the cache is cleared

3. Categories of Storage

Strictly necessary / essential

All of the items above are strictly necessary for the Application to function: to sign you in and verify your licence, to secure access to your Device, to store the data you create, and to provide offline use. The Application cannot operate without them, so they do not require consent under cookie/storage law.

Functional

The "remember this device" expiry and the backup-reminder snooze are functional conveniences that remember your choices. They are not used for tracking.

4. What We Do NOT Use

No advertising or marketing cookies.
No third-party analytics, telemetry or behavioural tracking.
No cross-site tracking or fingerprinting. The device identifier is a random value, not a hardware or browser fingerprint, and is used only to enforce the device limit.
No sale or sharing of any stored data for advertising.

5. Managing Your Data

You are in control of all on-device storage:

Use the Application's own export, backup and delete controls (under Settings → Data) to manage your training data.
Clear your browser's site data / storage for this Application to remove all localStorage keys, IndexedDB databases and caches. Doing so will permanently delete your training data and sign you out — back up first.
Block or restrict storage via your browser settings, though this will prevent the Application from functioning.
Sign out of the authentication provider to clear the sb-* session keys.

6. Legal Basis

Because every storage item is strictly necessary or functional for a service you have requested, we rely on the "strictly necessary" exemption under the UK Privacy and Electronic Communications Regulations (PECR) and equivalent EU ePrivacy rules, and, where personal data is involved, on the legal bases set out in our Privacy Policy.

7. Changes

We may update this policy as the Application evolves. The "Effective date" shows when it was last revised. Continued use after changes take effect constitutes acceptance.

8. Contact

Privacy: privacy@trefnus.co.uk
Support: support@trefnus.co.uk