Only the cookies the product actually needs.

1Strictly necessary cookies

These are required for the service to work at all. They cannot be switched off, because without them you cannot sign in or submit a form safely.

• Session cookie: keeps you signed in between requests. Marked Secure, HttpOnly and SameSite, scoped to the application host, and cleared when you sign out.
• Cross-site request forgery token: proves a state-changing request came from a TaxPio page rather than another site. Session lifetime.
• Sign-in flow state: short-lived values that carry an authentication attempt between the identity provider and the application. Minutes.
• Device recognition: set by the identity provider so it can tell a browser it has seen before from a fresh one, which is part of how sign-in abuse is detected.

2Preference storage

Interface preferences, such as which sections you have expanded, are kept in your browser's local storage rather than in a cookie. They stay on your device, are never sent to us, and clearing your browser data removes them.

3What we do not set

There are no advertising cookies, no cross-site tracking pixels, no social-network embeds, and no third-party analytics on TaxPio. Operational metrics are collected server-side and are not tied to an individual browser.

4Managing cookies

You can block or delete cookies in your browser settings. Blocking the strictly necessary cookies above will prevent you signing in, because the session cannot be maintained without them.