Cookies & Analytics

1. Browser storage and network requests

Harapan Kita uses cookies, local storage, session storage and service-worker caches for distinct purposes. Not every item is a cookie and not every external network request is analytics. Browser settings may block or delete storage, which can affect sign-in, remembered identity, poll continuity, installation and preferences. The same browser visiting a different origin may have separate storage and choices. An installed web app generally shares the browser engine’s site permissions rather than creating a verified government identity.

2. Authentication and service storage

Staff session and CSRF cookies default to casehub_session and casehub_csrf; their names are deployment-configurable. Staff sessions default to 12 hours and can be configured from 1 hour to 30 days. Server-side expiry and sign-out invalidate sessions; clearing a local cookie is not a server-data deletion request. Other browser records can remember language (public_complaint_language), intake point (public_portal_intake_unit_v1), resident details (public_portal_identity_v1), anonymous poll identifiers, likes, PWA prompts and display preferences. Local-storage items generally persist until changed, signed out where supported or cleared, rather than expiring like a session cookie.

Remembered resident data may contain name, IC and phone and is accessible to scripts running on this origin. Avoid saving another person’s details on a shared device. The PWA caches deployment assets and an offline fallback; the service worker is designed not to cache API responses, uploads or server-rendered case pages. Browser history, downloads, operating-system notifications and screenshots are outside that cache rule. Clear site storage and downloaded files when appropriate; clearing preferences also removes the local analytics opt-out.

3. Umami analytics, replays and heatmaps

The integration uses self-hosted Umami at umami.tootaio.com on listed production domains. It measures page paths, language, referral/campaign information, device/browser characteristics, performance, service interactions and aggregate success events. A recorder can capture masked layout, navigation, clicks and scrolling for replays and heatmaps. Recorded sessions are pseudonymous or technical records, not a guarantee that all collected data is legally anonymous. Network infrastructure can receive IP information even when the application avoids sending identity fields.

The integration excludes or masks form fields, identity and case areas, chats, public user content, dynamic images, invitations and sensitive links, and sanitises complaint-token paths and non-allowlisted URL parameters. These controls reduce exposure but are not a promise that a masking defect is impossible. Do not put personal data in campaign parameters. The documented operations plan uses 15% replay sampling and 100% heatmap sampling with a maximum 5-minute replay segment; live settings and cleanup must be rechecked. The documented 30-day replay and 90-day heatmap cleanup does not delete indefinite basic event/session records or automatically remove backups.

4. Analytics choices

Use the preference control below to disable this integration’s Umami tracker and recorder for the current origin/browser. The saved umami.disabled value is checked before the integration starts; save and reload to apply it. Turning it off does not erase past records, stop another open tab until it reloads, or control other sites, devices, security logs, CDN delivery or independently injected analytics. The integration also honours the browser’s Do Not Track signal. If browser storage is unavailable, use browser tracking controls. This is an opt-out control, not proof that prior opt-in consent was collected; the lawful basis and any required prior-consent mechanism must be assessed before publication.

5. External services and permissions

Cloudflare delivery, remotely hosted frontend libraries and icon APIs can receive network metadata when a page loads. Maps, social sharing and WhatsApp may open other origins with their own cookies and policies. The source code cannot establish whether the production CDN adds additional beacons or cookies; its configuration must be inventoried separately. Camera, file, location and notification permissions are controlled by the browser/device and should be requested for a stated function. Disabling Umami does not revoke those permissions. Use device settings to revoke them or remove an installed app.

6. Questions and changes

Contact the privacy channel for questions about a storage item, a recording, access to analytics or an unexpected tracker. Include the page and approximate time without attaching unnecessary private records. New trackers, expanded replay capture, advertising technology or materially different retention need a revised inventory and notice and any required consent before activation. The Privacy Policy explains general retention, security, suppliers and your rights; this document’s preference control applies only to the existing Umami integration.