Cookies policy

A cookie is a small file the browser stores for a site. Kova uses one cookie, and it is there so you can stay signed in.

Name: kova_refresh_token. It is set when you sign in and removed when you sign out.

It holds the refresh credential for your session. The browser sends it back to Kova so a new short-lived access token can be issued. The cookie is HttpOnly, so scripts on the page cannot read it. It uses SameSite Lax and lasts 7 days. On a live HTTPS site it is also marked Secure.

The access token itself is kept in memory for the open session. It is not stored in a cookie.

Kova does not set advertising cookies, analytics cookies, or third-party tracking cookies. Because this cookie is required to keep you signed in, the site does not ask you to opt in to it.

Sign out, and Kova deletes the cookie. You can also remove it in your browser settings. If you remove it, you will need to sign in again.