Cookie & Local Storage Policy

Last updated: June 2026

This policy explains exactly what we store on your device, why, how long it persists, and how to delete it. TatkalDone does not use advertising cookies, retargeting pixels, or cross-site tracking — we store what we need for sign-in, the booking flow, and security, and nothing else.

1. What counts as "storage" on this site

When you visit TatkalDone, three kinds of data may be stored on your device:

  • Cookies — small key/value strings set by our server and sent back automatically on each request. Used for your login session.
  • Local storage (browser API) — slightly larger key/value strings that stay on your device until you clear them and are not sent automatically with each request. Used for in-progress drafts and UI state.
  • Session storage (browser API) — the same as local storage, but cleared when you close the tab.

We use all three. We do not use Flash cookies, IndexedDB beyond Firebase's normal offline cache, or device fingerprinting.

2. Cookies set by TatkalDone

2.1 access_token — strictly necessary

  • What it is: a short-lived JSON Web Token signed by us.
  • Purpose: proves to our servers that you are signed in, on every API request you make.
  • Lifetime: 15 minutes from issue. Automatically refreshed by the app using your refresh token so you do not get logged out every 15 minutes.
  • Flags: httpOnly (JavaScript on the page cannot read it), secure in production (sent only over HTTPS), sameSite=strict (not sent on cross-site requests, which blocks CSRF).

You cannot opt out of this cookie and still use a logged-in feature — it is the equivalent of asking "can you check who I am without showing me your ID."

2.2 refresh_token — strictly necessary

  • What it is: an opaque random token. The server stores only its SHA-256 hash, never the token itself.
  • Purpose: lets the app silently get a new access token so you stay signed in across tabs and days.
  • Lifetime: 30 days. If the server ever sees a token whose hash does not match a stored, non-revoked record, the whole session is invalidated for safety.
  • Flags: httpOnly, secure in production, sameSite=strict.

You cannot opt out and stay logged in. Logging out revokes the token server-side and clears it from your browser.

2.3 session — strictly necessary (legacy)

  • What it is: an older Firebase Authentication session cookie used by accounts created before we migrated to the JWT scheme above.
  • Purpose: authenticates the account during the silent migration to JWT cookies on your next visit.
  • Lifetime: matches the Firebase session window; replaced the first time you visit any page after the migration.
  • Flags: httpOnly, secure in production.

You will not see this cookie if your account is new.

2.4 What we do not set

  • No advertising cookies.
  • No cross-site tracking cookies.
  • No third-party analytics tags that profile you across other sites.
  • No "social login" buttons that ping other networks on page load.

3. Local storage we use

Stored in your browser's local storage under tatkaldone-* keys. It persists until you clear it from browser settings or use the in-app sign-out.

3.1 Auth/role state

After sign-in we cache your role (user, agent, admin), your onboarding completeness, and your display name in local storage, so role-based UI does not flicker on each page load while the access token is being checked. This is a cache for snappiness, not a security boundary — every privileged action is re-authorised on the server using the access token cookie.

3.2 UI preferences

Theme (light/dark/system), font size if you changed it, dismissed banners, and similar UI flags.

3.3 What we do not store in local storage

  • Your password, OTP, card details, UPI PIN, CVV, or any other secret.
  • The contents of your KYC documents.
  • Other users' or agents' personal data.

4. Cookies Set by Service Providers

When you interact with features powered by third-party service providers, those providers may set their own cookies or use similar technologies on their own domains as part of their services.

  • Firebase Authentication (Google) — may set cookies during sign-in flows (phone OTP, Google Sign-In, and email/password authentication). These cookies are required for authentication and account security.
  • Razorpay — may set cookies on the Razorpay-hosted payment page while you complete a payment. These cookies help process payments securely and support fraud prevention.
  • Cloudinary — during direct uploads of KYC documents or ticket proof images, Cloudinary may use cookies or similar technologies on its own domain as required to provide its upload service.
  • Meta WhatsApp Cloud API — if you receive WhatsApp messages from us (such as booking notifications), message delivery is handled by Meta. Any cookies or similar technologies used within WhatsApp or WhatsApp Web are controlled by Meta and are subject to Meta's own privacy practices.

We do not control cookies or similar technologies used by these third-party providers. Their respective privacy and cookie policies govern their use.

5. Server-side data we associate with your session

For completeness, the following are stored on our servers, not on your device, but relate to your session:

  • The hash (not the raw value) of your refresh token, with its expiry and revocation flag.
  • A short-lived booking status cache in Redis, used to make the booking page fast.
  • Rate-limit counters (per phone, per IP, per endpoint) used to block brute-force OTP and login attempts.
  • One-time-password records that auto-expire 5 minutes after creation.

None of these are accessible to your browser.

6. Your choices

6.1 Clearing storage

You can clear cookies and local storage at any time from your browser settings. Doing so will:

  • Sign you out immediately.
  • Revert theme and UI preferences to defaults.

The server-side hash of your refresh token remains until it expires or is revoked (for example, when you sign out from all devices). This does not allow anyone to access your account because the browser cookie required to authenticate has been removed.

6.2 Blocking cookies

If you block our authentication cookies, you will be able to browse public pages (home, About Us, legal pages, Tatkal guide) but you will not be able to sign in or book.

6.3 Do-Not-Track / Global Privacy Control

We do not use cross-site tracking, so Do-Not-Track and Global Privacy Control signals do not change our behaviour — there is no tracking for them to suppress.

6.4 Signing out from all devices

From your profile page, use Sign out from all devices to revoke every refresh token associated with your account. The next page load on any device will land on the login screen.

7. WebView and mobile contexts

If you open TatkalDone inside a WebView embedded in another app, the same storage rules apply, but the cookies and local storage are scoped to that host app's WebView container — not to your device's main browser. Clearing the host app's data clears our storage too.

8. Updates to this policy

We will update this page if we add a new cookie category, a new local-storage key, or a new third-party service that sets cookies on our domain. If the change is material (for example, if we ever add analytics), give you a meaningful opt-out where the change is not strictly necessary.

9. Questions

For questions about cookies or any storage on your device, email support@tatkaldone.com. For formal data-protection complaints about how we handle this data, email support@tatkaldone.com or follow the Grievance Redressal Policy.

Questions? Email us at support@tatkaldone.com