Cookie Notice — IdeaScore

This notice explains the cookies and similar technologies (browser local storage and session storage) that IdeaScore uses, and why. It is published at /legal/cookies and supplements our Privacy Policy.

1. The Short Version

We use only cookies and storage that the Service needs to work securely, and to remember choices you make.
We use no advertising cookies, no third-party analytics and no tracking pixels.
Our application-form analytics are first-party and use no cookies. They do not store IP addresses, and they honour Do Not Track and Global Privacy Control.
In the IdeaScore app, everything we set is strictly necessary or remembers a choice you made, so the app shows no consent banner. If we ever add a cookie there that is not strictly necessary, we will ask for your consent first and update this notice.
On our website (ideascore.online), we set no cookies and run no analytics. We store only your cookie choice in your browser (as "ideascore.consent", for 12 months), so that we don't ask again. If we add analytics or anything else optional, it will load only after you agree in the consent banner. You can change your choice at any time from "Cookie settings" in the footer.

2. Cookies We Set

All our cookies are first-party and marked Secure (sent only over HTTPS) and SameSite=Lax. All but one (iscore_org, below) are also HttpOnly: scripts on the page cannot read them.

Name	Purpose	Duration
`session_token`	Keeps a User (staff, evaluator or other team member) signed in. Also used, read-only and time-limited, when our support staff use "View as" with your organisation's knowledge.	7 days; renewable while you are active, up to 30 days in all. Removed when you sign out. On the public demo at https://try.ideascore.online, 8 hours.
`applicant_session`	Keeps an Applicant signed in to the applicant portal.	30 days. Removed when you sign out. On the public demo, 8 hours.
`platform_session`	Keeps IdeaScore's own staff signed in to our administration console. Not set for customers.	7 days
`iscore_oauth_bind`	Ties a Google or Microsoft sign-in to the browser that started it, to prevent sign-in attacks. Sent only to the sign-in routes.	10 minutes
`iscore_device`	Remembers that this browser has finished signing in to an account before, so that our protections against password guessing (limits on attempts and temporary locks) and our limit on password-reset emails do not shut the account's owner out of a browser they have used before. It holds a random identifier for the browser and a short code for each account signed in on it (at most eight), made with a secret key held on our servers; it does not contain your email address or password. Set when a User, or one of our own staff, finishes signing in. Sent only to the Service's API.	180 days from the last sign-in on that browser
`upload_receipt`	Ties the files you upload to a programme's application form without being signed in to the browser you upload them from, so that nobody else can attach them to an application. It holds a random value, of which we keep only a one-way hash. Sent only to the Service's API.	60 days. Removed when you submit the application.
`iscore_org`	Remembers the organisation you chose at sign-in, so that files open in that organisation where one web address serves several. Written by the app's own script, so it is not `HttpOnly`; sent only to the addresses that serve files, and it never decides who may open a file.	30 days, or until you choose another organisation

3. Browser Storage We Use

The app also stores small items in your browser's local storage (kept until you or the app clear it) and session storage (cleared when you close the tab). They stay on your device; the app reads them, and they are not sent to us automatically.

What	Examples	Type
Display preferences	Light or dark theme (`iscore_theme`), your saved preferences (`iscore:prefs`), whether the side rail is collapsed, which report sections are open, the pitch-board theme	Local storage
Organisation choice	The organisation you chose at sign-in, where one address serves several (`iscore_org`; also kept as the cookie of the same name, section 2)	Local storage
Application drafts	The answers you have typed into a programme's application form on this device, so that you do not lose them if the page closes (`iscore_registration_draft_<programme>`), and a pointer to a draft saved on our servers. Removed when you submit.	Local storage
Unsent changes	Changes that could not be sent because the connection dropped, retried automatically when you are back online (`iscore_resilient_queue_v1`)	Session storage
Interface state	Dismissed banners and notices, guided tours you have seen, help-article feedback you gave, which IdeaScore AI panels you expanded, recently used programme names, and the help assistant's current conversation	Local or session storage

On a shared or public computer, sign out and close the browser when you finish. Drafts of application answers are kept in that browser until you submit or clear them.

4. Third Parties

Cloudflare, which protects and delivers the Service, may set strictly necessary security cookies (for example __cf_bm or cf_clearance) to distinguish people from automated traffic. See Cloudflare's cookie policy.
Payment pages. When you pay online, you use Razorpay's or Stripe's checkout, which sets its own cookies for payment security and fraud prevention under its own policy.
Embedded videos and documents. If an application includes a link to a video on YouTube or a similar site, or to a pitch deck or document in Google Drive, Google Docs, Slides or Sheets, and you open or play it inside the Service, that site may set its own cookies under its own policy. A link to a PDF or Office file is shown through the Google Docs viewer, which fetches the file from that link and may set Google's cookies.
Google and Microsoft sign-in. If you choose to sign in with Google or Microsoft, you are taken to their sign-in page, which uses their own cookies.

We do not control these cookies. Please read the relevant provider's policy.

5. Your Choices

You can block or delete cookies and storage in your browser's settings. If you block our cookies, you will not be able to sign in. If you clear local storage, you will lose saved display preferences and any application draft kept only on that device.

6. Changes and Contact

We will update this notice if we change the cookies or storage we use. Questions: [email protected].