Cookie Policy

Cogitto application cookies

The __Host-cogitto-customer-flow cookie connects your browser to an unfinished sign-in or identity-confirmation flow. Its maximum lifetime is 15 minutes.

The __Host-cogitto-customer-session cookie identifies your signed-in session. Its maximum lifetime is 12 hours; the server also enforces a 30-minute inactivity limit. Signing out clears the session cookie and invalidates the application session.

These cookies contain opaque handles, not your password or email verification code. Production cookies use Secure, HttpOnly and SameSite=Lax protections.

Hosted sign-in and infrastructure

Microsoft’s hosted identity pages use their own cookies and browser storage to carry out sign-in, verification, recovery and security controls. Their names and lifetimes can vary with the flow and provider. A Cogitto session ending does not necessarily end every Microsoft browser session.

Azure infrastructure may also use service-routing cookies. These are distinct from optional advertising or audience measurement. Following a reference-source link is governed by the destination website’s cookie practices.

Choices and effects

There are no optional cookie categories to enable or disable in the current release. Cookie preferences shows this status; it does not create a consent record or pretend to disable essential sign-in technology.

You can block or delete cookies in your browser. Blocking necessary cookies can prevent sign-in, account recovery or workspace access. Use Sign out in your account to end the Cogitto session before clearing browser data.

Changes and contact

If optional technologies are introduced, we will update this information and provide working choices where required before enabling them. Contact support@cogitto.com with the subject “Cogitto privacy” for questions.