mait.sh1.59.1
Legal

Cookie policy

How mait.sh uses cookies and similar browser storage technologies.

What are cookies

Cookies are small text files a website asks your browser to keep on your device. They are how a site remembers that you are signed in, or what you chose last time you visited. Browsers also offer two closely related stores, localStorage and sessionStorage, which do much the same job without being sent back to the server with every request. We list those here too, because from your point of view they are the same thing: data this site keeps in your browser.

Cookies and browser storage we use

The table below is the complete list — everything this site puts in your browser, and nothing else. All of it is first-party, set by us for this site. We use no advertising cookies, no cross-site tracking cookies, and no third-party analytics cookies.

NAMETYPEPURPOSEEXPIRY
_oauth2_proxy, _oauth2_proxy_gh, _oauth2_proxy_msRequiredCreated when you sign in with Google, GitHub, or Microsoft respectively, and holds your encrypted sign-in session. Set on the .mait.sh domain, so one sign-in also covers our other subdomains. A large session is split across numbered siblings (…_0, …_1, …_2). HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.7 days
_oauth2_proxy_csrf, _oauth2_proxy_gh_csrf, _oauth2_proxy_ms_csrfRequiredProtects the sign-in redirect against cross-site request forgery. Written when a sign-in starts and discarded the moment it completes. HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.15 minutes
mait-sessionRequiredKeeps you signed in on this site, and carries your email address, display name, and which provider you used. Set only for the exact site you signed in on, not across our subdomains. It is signed rather than encrypted, so anyone holding the cookie can read those values — though they cannot alter them undetected. HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.7 days
mait-join-interestFunctionalCarries the two checkboxes on the join page ("I want to support" / "I want to contribute") across the sign-in redirect, so your choices can be saved to your new account. It holds two digits and nothing else. Written by the page itself, so scripts on this site can read it. Cleared as soon as it has been applied; if you abandon the sign-in, it expires on its own. First-party, SameSite Lax.10 minutes
mait-themeFunctionalRemembers whether you chose the light or the dark theme. Kept in browser localStorage, never sent to our servers. First-party.Until cleared
mait-private-beta-noticeNECESSARYRemembers that you dismissed the private-beta notice in this browser tab. Kept in sessionStorage, never sent to our servers, and does not control tracking or consent.Browser tab session
mait-cookie-noticeFunctionalRemembers that you have dismissed the notice at the bottom of the page, so it is not shown to you again. It records a dismissal, not a consent choice — nothing on this site is switched on or off by it. Kept in browser localStorage, never sent to our servers. First-party.Until cleared
mait-behavior-consentFunctionalRecords that you have declined click/button tracking — see "Usage and error diagnostics" below for what that covers and its current status. Absence of this entry means tracking is allowed once the capability runs, matching this notice’s opt-out model; only an explicit decline is ever written. Kept in browser localStorage, never sent to our servers. First-party.Until cleared
com.grafana.faro.sessionDiagnosticsA random identifier that groups the diagnostic events from a single visit, so an error can be tied to the pages that led to it. It is not linked to any earlier visit, and is replaced after 4 hours or after fifteen minutes of inactivity. Kept in browser sessionStorage by the diagnostics agent described below. First-party.Browser tab session
com.grafana.faro.lastNavigationIdDiagnosticsBookkeeping for the same agent: the identifier of the previous page load, so a page-performance measurement can be attributed to the navigation that produced it. Kept in browser sessionStorage. First-party.Browser tab session
NAME
_oauth2_proxy, _oauth2_proxy_gh, _oauth2_proxy_ms
TYPE
Required
PURPOSE
Created when you sign in with Google, GitHub, or Microsoft respectively, and holds your encrypted sign-in session. Set on the .mait.sh domain, so one sign-in also covers our other subdomains. A large session is split across numbered siblings (…_0, …_1, …_2). HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.
EXPIRY
7 days
NAME
_oauth2_proxy_csrf, _oauth2_proxy_gh_csrf, _oauth2_proxy_ms_csrf
TYPE
Required
PURPOSE
Protects the sign-in redirect against cross-site request forgery. Written when a sign-in starts and discarded the moment it completes. HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.
EXPIRY
15 minutes
NAME
mait-session
TYPE
Required
PURPOSE
Keeps you signed in on this site, and carries your email address, display name, and which provider you used. Set only for the exact site you signed in on, not across our subdomains. It is signed rather than encrypted, so anyone holding the cookie can read those values — though they cannot alter them undetected. HttpOnly, Secure, SameSite Lax. First-party; cannot be disabled.
EXPIRY
7 days
NAME
mait-join-interest
TYPE
Functional
PURPOSE
Carries the two checkboxes on the join page ("I want to support" / "I want to contribute") across the sign-in redirect, so your choices can be saved to your new account. It holds two digits and nothing else. Written by the page itself, so scripts on this site can read it. Cleared as soon as it has been applied; if you abandon the sign-in, it expires on its own. First-party, SameSite Lax.
EXPIRY
10 minutes
NAME
mait-theme
TYPE
Functional
PURPOSE
Remembers whether you chose the light or the dark theme. Kept in browser localStorage, never sent to our servers. First-party.
EXPIRY
Until cleared
NAME
mait-private-beta-notice
TYPE
NECESSARY
PURPOSE
Remembers that you dismissed the private-beta notice in this browser tab. Kept in sessionStorage, never sent to our servers, and does not control tracking or consent.
EXPIRY
Browser tab session
NAME
mait-cookie-notice
TYPE
Functional
PURPOSE
Remembers that you have dismissed the notice at the bottom of the page, so it is not shown to you again. It records a dismissal, not a consent choice — nothing on this site is switched on or off by it. Kept in browser localStorage, never sent to our servers. First-party.
EXPIRY
Until cleared
NAME
mait-behavior-consent
TYPE
Functional
PURPOSE
Records that you have declined click/button tracking — see "Usage and error diagnostics" below for what that covers and its current status. Absence of this entry means tracking is allowed once the capability runs, matching this notice’s opt-out model; only an explicit decline is ever written. Kept in browser localStorage, never sent to our servers. First-party.
EXPIRY
Until cleared
NAME
com.grafana.faro.session
TYPE
Diagnostics
PURPOSE
A random identifier that groups the diagnostic events from a single visit, so an error can be tied to the pages that led to it. It is not linked to any earlier visit, and is replaced after 4 hours or after fifteen minutes of inactivity. Kept in browser sessionStorage by the diagnostics agent described below. First-party.
EXPIRY
Browser tab session
NAME
com.grafana.faro.lastNavigationId
TYPE
Diagnostics
PURPOSE
Bookkeeping for the same agent: the identifier of the previous page load, so a page-performance measurement can be attributed to the navigation that produced it. Kept in browser sessionStorage. First-party.
EXPIRY
Browser tab session

On our internal development channel only, a single sign-in cookie named _oauth2_proxy_htpasswd stands in for the three provider cookies. It is scoped to that one host and never appears on the public site.

Usage and error diagnostics

Where diagnostics are switched on, a small agent runs in your browser and reports faults back to us so we can find and fix them. It sends:

  • the pages and in-app views you open, including the full address of each;
  • standard measurements of how quickly the page loaded and responded;
  • JavaScript errors, with their stack traces;
  • messages the page writes to the browser console at information, warning, and error level — debug and trace messages are not captured;
  • the address and timing of the requests the page makes back to us;
  • browser security-policy violations, on the rare occasions one occurs;
  • your browser and operating system, their user-agent string, your browser language, and the size of your browser window;
  • the two session identifiers listed in the table above.

Equally important, here is what it does not do. It does not record what you type or what you enter into forms. It takes no screenshots and does no session replay. And sign-in codes and access tokens are stripped out of every address before anything leaves your browser. Separately, from what's described in the next paragraph: which button you clicked, for a short, fixed list of specific buttons.

Click tracking. A separate, closely related capability — reporting which specific buttons or links you click — is built, merged, and reviewed as of August 20, 2026, but not yet running on any channel; this section will be updated the moment it deploys. Once it does, it covers a short, fixed list of actions: the "Join waitlist" button on our homepage, and starting sign-in with any provider. It can only ever happen for a visitor who has separately accepted diagnostics above — accepting diagnostics does not, by itself, turn this on too; you get a separate say. We built that opt-out before turning click tracking on, not after: our cookie notice's "Don't track my clicks" button and the mait-behavior-consent entry above exist so that everyone — signed in or not — already has a working way to say no, on the same terms as everyone else, from the moment this capability turns on. Declining takes effect immediately, in the tab you declined in; turning it back on takes effect from your next visit. You can change your mind at any time, below or on our privacy policy.

This is not a third-party analytics service. The software is Grafana Faro, but we run both the collector and the storage ourselves on our own EU infrastructure — nothing goes to Grafana Labs, to an advertising network, or to an analytics company. The data is kept for 7 days and then deleted automatically. It sets no cookies at all; the only browser storage it needs is the two sessionStorage entries above.

Diagnostics run across our Edge, Beta, and Stable channels alike, not on a single preview channel.

If you are signed in, diagnostics are linked to your MAIT account identifier — a random identifier, never your email address or your name — and you can switch them off at any time from your account page. We check that setting before sending anything, and nothing leaves your browser while we are still checking. If you are not signed in, diagnostics are not linked to any account, but as of this writing there is no way to switch these off before signing in; blocking scripts from that host in your browser prevents them entirely. This is a separate control from the click-tracking opt-out above, which anonymous visitors do have — the two gate different, independent capabilities.

Decided and built, not yet deployed: we have changed this. Diagnostics now move from an opt-out default to a real accept/reject choice presented before the agent starts on any page, available to signed-in and signed-out visitors alike, built by extending this same cookie banner. This is merged into our codebase but not yet running on any channel; until it is deployed, the paragraph above describes what visitors actually experience today.

Your choices for this site

Both toggles below apply to the mait.sh web portal only — not our CLI tools or other products, which have their own preference on your account page once signed in. These are the same choice for every visitor, signed in or not; if you are signed in, your account page also has an additional, advanced override layer for both.

Third-party cookies

We set no third-party cookies. When you choose to sign in, you are sent to Google, GitHub, or Microsoft, and those companies set their own cookies on their own domains under their own policies — that is how they keep you signed in with them. We cannot read those cookies, and we set nothing on your device on their behalf.

How to manage cookies

Every major browser lets you block or delete cookies, usually under "Settings", "Privacy", or "Security". Note that the sign-in cookies in the table above are the mechanism that keeps you signed in: blocking them means you will not be able to sign in at all.

The browser-storage entries — mait-theme, mait-cookie-notice, mait-private-beta-notice, the diagnostics and click-tracking consent records, and the two com.grafana.faro.* entries — are not covered by those cookie settings.

To clear localStorage items (mait-theme, mait-cookie-notice, mait-behavior-consent, mait-diagnostics-consent), use your browser's developer tools or clear all site data in your browser settings.

Contact

For questions about our use of cookies, see our privacy policy or write to us at privacy@mait.sh.

Last updated

August 20, 2026