Your Choice
PoliData, operated by Allan Kirui (see the Privacy Policy), uses cookies and browser storage that are necessary for security, sign-in, service continuity, and preferences. They cannot be disabled through our controls because the relevant feature would not work without them; they are used without consent because they are strictly necessary for the service you ask for (Article 5(3) of the ePrivacy Directive and Article 399 of the Polish Electronic Communications Law), and each lasts only as long as that purpose needs. Optional Umami Cloud analytics remains disabled until you affirmatively allow it. Refusing analytics does not limit the service.
Privacy-friendly product analytics
Optional cookieless usage data helps us improve PoliData. It remains off until you allow it, and you can withdraw permission at any time.
Current choice: Not selected
When you are signed in, your choice is also saved to your account and applies on every device you sign in on.
Necessary Cookies
On getpolidata.com, the account sign-in cookies below use the __Host- prefix, which browsers accept only over HTTPS and only from this site, never from another getpolidata.com subdomain. Local development uses the same names without the prefix.
| Name | Purpose | Typical duration |
|---|---|---|
| __Host-authjs.user-session (and .0, .1 parts for a large session) | Keeps you signed in. It holds an encrypted token linked to a sign-in session on our servers, which you can end from the Devices list under Sign-in & security in your account | Unless you tick Keep me signed in when you sign in: until you close the browser, and the sign-in ends 12 hours after it started even if the browser keeps the cookie. With Keep me signed in: up to 30 days, renewed as you use PoliData; the sign-in itself ends after 30 days without use or 90 days at most |
| __Host-authjs.user-csrf | Protects sign-in and sign-out against cross-site request forgery | Until you close the browser |
| __Host-authjs.user-callback-url | Returns you to the right page after signing in (after a sign-up with Google or Microsoft, the signup form with the plan you chose) and, for a Google or Microsoft sign-in, carries your Keep me signed in choice through it | Until you close the browser |
| __Host-pd-device | A random identifier for this browser, set when you sign in. Only a one-way hash of it is stored with your sign-in sessions, so we can recognize a new device and email you when your account signs in on one. It has no other use | 90 days from the last sign-in, the period after which a device counts as new |
| __Host-pd-mfa | Only when you sign in with Google or Microsoft and your account uses two-step verification: holds a short-lived reference to the unfinished sign-in while you complete the second step | 5 minutes |
| __Host-pd-consent | Only when you sign in with Google or Microsoft and must first accept an updated Privacy Policy or Terms: holds a short-lived reference to the unfinished sign-in while you do | 5 minutes |
| __Host-pd-link | Only while you connect a Google or Microsoft account to your PoliData account: holds a short-lived reference to that request | 10 minutes; removed when you confirm or sign out |
| __Host-pd-signup | Only while you create an account with Google or Microsoft: holds a short-lived reference to the unfinished sign-up while you choose a plan and accept the Terms, and, when we email you a code to confirm your address, ties that code to your sign-up | 30 minutes; removed when your account is created, when you choose another way to sign up, or when you sign in or out |
| __Host-authjs.state, __Host-authjs.pkce.code_verifier, __Host-authjs.nonce | Only when you sign in with, sign up with, or connect Google or Microsoft: one-time values that check the provider's reply belongs to the sign-in you started | Removed once used; at most 15 minutes |
| authjs.admin-session, authjs.admin-csrf, authjs.admin-callback-url | PoliData staff only: platform-administrator sign-in, request-forgery protection, and post-sign-in navigation | Up to 30 days for the session; the others until you close the browser |
| __Host-studio-handoff-csrf | PoliData staff only: protects the hand-off from platform administration to the editorial studio | 5 minutes |
| polidata-start-page | Your chosen start page, copied from your interface preferences, so a signed-in visit to PoliData opens it directly | 30 days, no longer than a sign-in can last; removed when you sign out |
| polidata-default-jurisdiction | A copy of the default jurisdiction you chose in Settings, so that setting shows your choice | 30 days, no longer than a sign-in can last; removed when you sign out |
| NEXT_LOCALE | Remembers the language edition of the site you chose, when it differs from your browser's language | Until you close the browser |
Necessary Browser Storage
| Name or group | Purpose | Duration |
|---|---|---|
| polidata-product-analytics | Records the analytics choice, policy version, and choice date and, for a choice made while signed in, your account identifier, so that choice applies here only while that account is signed in | 6 months; an older explicit refusal is preserved during migration; signing out removes a choice that came from your account |
| polidata-ui | The theme, whether the sidebar is collapsed, and a copy of the interface preferences saved to your account (language, theme, start page, and navigation order and visibility), labelled with your account identifier so they are not applied to another account | Until changed or browser data is cleared; signing out removes your account's copy except the theme |
| polidata-theme | A theme choice saved by an earlier version of PoliData, read only if no newer choice exists | Until browser data is cleared |
| polidata_jurisdiction, polidata_terms, legislation-view | Selected jurisdiction, legislative term, and list-view preferences | Until changed or browser data is cleared |
| polidata_notifications, polidata.bell.dismissedIds | Local notification and dismissal state | Until updated or browser data is cleared |
| pd-email-change-confirm, pd-email-change-undo | Only after you open an email link to confirm or undo a change of your account's email address: the one-time code from the link, kept in session storage after it is removed from the address bar so the change can finish, including after you sign in | This tab only; removed once used or found invalid, and when you close the tab |
| polidata-legal-advance-notice | Remembers that you dismissed the banner announcing an upcoming change to our legal documents | Until a newer change is announced or browser data is cleared |
PoliData does not keep search history in cookies or browser storage. Search history used for personalization is stored in your account on our servers, as described in the Privacy Policy. Earlier versions kept recent command-search text in this browser under polidata_recent_searches; PoliData now deletes that entry, and any older local search-activity entries, the next time you open the signed-in workspace.
Earlier versions of PoliData also described access_token, refresh_token, pa_access_token, and pa_refresh_token cookies. PoliData no longer sets them; your sign-in now relies on the session cookies above and a session record on our servers.
Optional Umami Analytics
Umami does not set analytics cookies, but its JavaScript accesses browser and device information and sends analytics requests to Umami Cloud. When allowed, it records page paths without query strings or URL fragments, referrer, browser, operating system, device type, screen size, language, approximate location, and a restricted list of product events. It derives cookieless sessions from IP address, user agent, and the PoliData website identifier. Signed-in activity may be associated with one-way keyed user and organization aliases, role, and default jurisdiction.
We do not send names, email addresses, raw account or organization IDs, legislative-item IDs, search text, query strings, URL fragments, or Web Vitals to Umami. The analytics script, automatic pageviews, identity request, and product events are all blocked unless your current choice is Allow analytics.
Choice Duration and Withdrawal
We retain both acceptance and refusal choices for up to six months so we do not repeatedly ask. We request a new choice after that period or sooner if the analytics provider, purpose, or categories of information materially change. A choice you make while signed in, in the privacy banner, above, or in Settings, is also saved to your account with the policy version and date, so it applies on every device where you sign in and replaces that browser's own choice while you are signed in. A choice made while signed out applies only to that browser. You can withdraw consent as easily as you gave it by switching analytics off above or in Settings; while signed in, that withdrawal reaches your other devices the next time they load PoliData. Disabling analytics reloads the page to stop the active tracker. Global Privacy Control and Do Not Track signals also disable analytics.
Browser Controls
You can delete cookies and local storage through browser settings. Doing so may sign you out, remove saved interface preferences, and cause the privacy-choice prompt to appear again. Your interface preferences stay saved with your account and return the next time you sign in. Blocking necessary storage may prevent authentication or other requested features from working.