mait.sh1.142.0

Private beta: features and content may change. No warranty; use at your own risk.

Legal

Cookie policy

How mait.sh, staff.mait.sh and xcaio.mait.sh use cookies and similar browser storage.

What cookies are

Cookies are small text files a website asks your browser to keep. They let a site remember that you are signed in, or what you chose last time. Browsers also have localStorage and sessionStorage, which do a similar job but are not sent to the server with each request. We list those here too, because from your point of view they are the same thing: data a site keeps in your browser.

Your choice when you first visit

On your first visit, a bar at the bottom of the page offers Accept diagnostics or Decline diagnostics.

  • Until you choose, the site stores nothing in your browser apart from what is strictly necessary for something you do, such as signing in. The diagnostics agent does not load.
  • If you accept, the diagnostics agent starts and stores two session-only entries (see "Diagnostics" below).
  • If you decline, it never starts.

Either way we store your answer in the mait-diagnostics-consent cookie on the mait.sh domain, so one answer covers mait.sh, staff.mait.sh and xCAIO in that browser, and none of them asks again. The cookie lasts 180 days. After that, the bar asks again.

On mait.sh, an explicit acceptance also sends a small acceptance observation to our own server. It contains only accepted, without sign-in cookies, an account or session identifier, or the address of the page you accepted on. We count received observations, including repeated choices; they are not counts of people. Reading an existing choice or reloading a page sends no acceptance observation. We send no observation for a decline, so declined choices are unmeasured and we cannot calculate an acceptance percentage. Requests already sent before withdrawal cannot be recalled.

Cookies and browser storage we use

This is the complete list. Everything is first-party: we set it, for our own sites. We use no advertising cookies, no cross-site tracking cookies and no third-party analytics.

Strictly necessary: mait.sh

These cannot be turned off. The site cannot sign you in or remember your answers without them.

NameTypePurposeLifetime
_oauth2_proxy, _oauth2_proxy_gh, _oauth2_proxy_msCookie (HttpOnly, Secure, SameSite Lax)Your encrypted sign-in session with Google, GitHub or Microsoft. It is set on the whole mait.sh domain, so one sign-in also works on staff.mait.sh and xCAIO. A large session is split into numbered parts (…_0, …_1, …).7 days
_oauth2_proxy_csrf, _oauth2_proxy_gh_csrf, _oauth2_proxy_ms_csrfCookie (HttpOnly, Secure, SameSite Lax)Protects the sign-in redirect against cross-site request forgery. Written when a sign-in starts.15 minutes
mait-sessionCookie (HttpOnly, Secure, SameSite Lax)Keeps you signed in on this site. It holds your email address, name, sign-in provider, provider account identifier, email-verification status and whether you are MAIT staff (a contributor or supporter the MAIT Team has enabled for staff features). It is signed, so it cannot be altered without detection. It is not encrypted, so anyone who gets hold of the cookie can read those values. It applies only to the site you signed in on.7 days
mait-link-intentCookie (HttpOnly, Secure, SameSite Lax)Set only when you link another sign-in provider from your account page. It ties the provider's reply to your current session.10 minutes, or until linking finishes
xcaio_handoff_bridgeCookie (HttpOnly, Secure, SameSite Strict)Set only while you sign in to xCAIO. It carries the signed, single-use sign-in message (identifier, name, email, provider) across one redirect, on one path only.60 seconds
mait-join-interestCookie (SameSite Lax; readable by the page's scripts)Carries your choices on the join page ("I want to support", "I want to contribute" and the roles under "Your work") through the sign-in redirect, so they can be saved to your new account. It holds only on/off digits. It is cleared once applied.10 minutes
mait-diagnostics-consentCookie (Secure, SameSite Lax; readable by the page's scripts), set on the whole mait.sh domainYour answer on the diagnostics bar or on the switch below: accepted or declined. It is shared by mait.sh, staff.mait.sh and xCAIO, so one answer covers all three. Our pages read it only in your browser. As a cookie, it is also sent to our servers, which do not use it.180 days
mait-diagnostics-consentlocalStorageAn answer recorded on this site alone before the shared cookie existed. It is only read to keep an earlier decline, and removed when you next choose. Never sent to our servers.Until you choose again or clear it
mait-cookie-noticelocalStorageRecords that you have answered the diagnostics bar, so it is not shown again. Never sent to our servers.Until you clear it
mait-behavior-consentlocalStorageWritten only if you turn click tracking off. It holds the value denied. If this entry is missing, click tracking follows your diagnostics choice. Never sent to our servers.Until you clear it
mait-themelocalStorageWritten only if you change the light/dark theme. Never sent to our servers.Until you clear it
mait-private-beta-noticesessionStorageRecords that you closed the private-beta notice in this tab. Never sent to our servers.Until you close the tab
Name
_oauth2_proxy, _oauth2_proxy_gh, _oauth2_proxy_ms
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Your encrypted sign-in session with Google, GitHub or Microsoft. It is set on the whole mait.sh domain, so one sign-in also works on staff.mait.sh and xCAIO. A large session is split into numbered parts (…_0, …_1, …).
Lifetime
7 days
Name
_oauth2_proxy_csrf, _oauth2_proxy_gh_csrf, _oauth2_proxy_ms_csrf
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Protects the sign-in redirect against cross-site request forgery. Written when a sign-in starts.
Lifetime
15 minutes
Name
mait-session
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Keeps you signed in on this site. It holds your email address, name, sign-in provider, provider account identifier, email-verification status and whether you are MAIT staff (a contributor or supporter the MAIT Team has enabled for staff features). It is signed, so it cannot be altered without detection. It is not encrypted, so anyone who gets hold of the cookie can read those values. It applies only to the site you signed in on.
Lifetime
7 days
Name
mait-link-intent
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Set only when you link another sign-in provider from your account page. It ties the provider's reply to your current session.
Lifetime
10 minutes, or until linking finishes
Name
xcaio_handoff_bridge
Type
Cookie (HttpOnly, Secure, SameSite Strict)
Purpose
Set only while you sign in to xCAIO. It carries the signed, single-use sign-in message (identifier, name, email, provider) across one redirect, on one path only.
Lifetime
60 seconds
Name
mait-join-interest
Type
Cookie (SameSite Lax; readable by the page's scripts)
Purpose
Carries your choices on the join page ("I want to support", "I want to contribute" and the roles under "Your work") through the sign-in redirect, so they can be saved to your new account. It holds only on/off digits. It is cleared once applied.
Lifetime
10 minutes
Name
mait-diagnostics-consent
Type
Cookie (Secure, SameSite Lax; readable by the page's scripts), set on the whole mait.sh domain
Purpose
Your answer on the diagnostics bar or on the switch below: accepted or declined. It is shared by mait.sh, staff.mait.sh and xCAIO, so one answer covers all three. Our pages read it only in your browser. As a cookie, it is also sent to our servers, which do not use it.
Lifetime
180 days
Name
mait-diagnostics-consent
Type
localStorage
Purpose
An answer recorded on this site alone before the shared cookie existed. It is only read to keep an earlier decline, and removed when you next choose. Never sent to our servers.
Lifetime
Until you choose again or clear it
Name
mait-cookie-notice
Type
localStorage
Purpose
Records that you have answered the diagnostics bar, so it is not shown again. Never sent to our servers.
Lifetime
Until you clear it
Name
mait-behavior-consent
Type
localStorage
Purpose
Written only if you turn click tracking off. It holds the value denied. If this entry is missing, click tracking follows your diagnostics choice. Never sent to our servers.
Lifetime
Until you clear it
Name
mait-theme
Type
localStorage
Purpose
Written only if you change the light/dark theme. Never sent to our servers.
Lifetime
Until you clear it
Name
mait-private-beta-notice
Type
sessionStorage
Purpose
Records that you closed the private-beta notice in this tab. Never sent to our servers.
Lifetime
Until you close the tab

On our internal development channel only, a single sign-in cookie named _oauth2_proxy_htpasswd replaces the three provider cookies. It is limited to that host and never appears on the public sites.

Strictly necessary: staff.mait.sh

NameTypePurposeLifetime
staff-sessionCookie (HttpOnly, Secure, SameSite Lax)Keeps you signed in to the staff portal. It holds your email address, name, sign-in provider, provider account identifier, email-verification status and staff flag. It is signed, not encrypted.7 days
staff-login-nonceCookie (HttpOnly, Secure, SameSite Lax; sent only to the sign-in callback)A random, single-use value that ties the sign-in reply from mait.sh to your browser.10 minutes
mait-cookie-notice, mait-theme, and the earlier mait-diagnostics-consent entrylocalStorageSame as on mait.sh, kept separately for staff.mait.sh.Until you clear them
Name
staff-session
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Keeps you signed in to the staff portal. It holds your email address, name, sign-in provider, provider account identifier, email-verification status and staff flag. It is signed, not encrypted.
Lifetime
7 days
Name
staff-login-nonce
Type
Cookie (HttpOnly, Secure, SameSite Lax; sent only to the sign-in callback)
Purpose
A random, single-use value that ties the sign-in reply from mait.sh to your browser.
Lifetime
10 minutes
Name
mait-cookie-notice, mait-theme, and the earlier mait-diagnostics-consent entry
Type
localStorage
Purpose
Same as on mait.sh, kept separately for staff.mait.sh.
Lifetime
Until you clear them

The shared mait-diagnostics-consent cookie holds your diagnostics answer here too. The mait.sh sign-in cookies (_oauth2_proxy*) are also sent to staff.mait.sh, which checks that your sign-in is still valid.

Strictly necessary: xCAIO (xcaio.mait.sh)

NameTypePurposeLifetime
xcaio-sessionCookie (HttpOnly, Secure, SameSite Lax)Keeps you signed in to xCAIO. It holds your provider account identifier, sign-in provider, name, email address and email-verification status. It is signed, not encrypted.7 days
xcaio-login-nonceCookie (HttpOnly, Secure, SameSite Lax; sent only to the sign-in callback)A random, single-use value that ties the sign-in reply from mait.sh to your browser.10 minutes
xcaio-diagnostics-consentlocalStorageAn answer recorded on xCAIO alone before the shared cookie existed. It is only read to keep an earlier decline, and removed when you next choose.Until you choose again or clear it
themelocalStorageWritten only if you change the light/dark theme on xCAIO.Until you clear it
xcaio-private-beta-noticesessionStorageRecords that you closed xCAIO's private-beta notice in this tab.Until you close the tab
Name
xcaio-session
Type
Cookie (HttpOnly, Secure, SameSite Lax)
Purpose
Keeps you signed in to xCAIO. It holds your provider account identifier, sign-in provider, name, email address and email-verification status. It is signed, not encrypted.
Lifetime
7 days
Name
xcaio-login-nonce
Type
Cookie (HttpOnly, Secure, SameSite Lax; sent only to the sign-in callback)
Purpose
A random, single-use value that ties the sign-in reply from mait.sh to your browser.
Lifetime
10 minutes
Name
xcaio-diagnostics-consent
Type
localStorage
Purpose
An answer recorded on xCAIO alone before the shared cookie existed. It is only read to keep an earlier decline, and removed when you next choose.
Lifetime
Until you choose again or clear it
Name
theme
Type
localStorage
Purpose
Written only if you change the light/dark theme on xCAIO.
Lifetime
Until you clear it
Name
xcaio-private-beta-notice
Type
sessionStorage
Purpose
Records that you closed xCAIO's private-beta notice in this tab.
Lifetime
Until you close the tab

The shared mait-diagnostics-consent cookie holds your diagnostics answer on xCAIO too. The mait.sh sign-in cookies (_oauth2_proxy*) are also sent to xCAIO, which checks that your sign-in is still valid.

Diagnostics: only after you accept

NameTypePurposeLifetime
com.grafana.faro.sessionsessionStorageA random identifier that groups the diagnostics from one visit, so an error can be matched to the pages that led to it. It is not linked to earlier visits.Until you close the tab. A new one starts after 4 hours, or after 15 minutes of inactivity
com.grafana.faro.lastNavigationIdsessionStorageThe identifier of the previous page load, so a timing measurement can be matched to the right page.Until you close the tab
Name
com.grafana.faro.session
Type
sessionStorage
Purpose
A random identifier that groups the diagnostics from one visit, so an error can be matched to the pages that led to it. It is not linked to earlier visits.
Lifetime
Until you close the tab. A new one starts after 4 hours, or after 15 minutes of inactivity
Name
com.grafana.faro.lastNavigationId
Type
sessionStorage
Purpose
The identifier of the previous page load, so a timing measurement can be matched to the right page.
Lifetime
Until you close the tab

The diagnostics agent sets no cookies. The diagnostics collector never receives your sign-in cookies: our servers remove cookies from requests to it.

Diagnostics

If you accept diagnostics, our agent (Grafana Faro) sends the following to a collector on our own servers in the EU:

  • the pages you open, with their full addresses
  • on mait.sh, a coarse category for the referring page when diagnostics start: internal, recognised search engine, recognised social site, other, or direct-or-unavailable. We send no referring address, domain or query with this category. An empty browser referrer can mean a direct visit or that the browser withheld it
  • page-load and responsiveness timings
  • JavaScript errors, with their stack traces
  • console messages at information, warning and error level
  • the addresses and timings of requests the page makes to our own servers
  • security-policy violation reports from your browser
  • your browser, operating system, user-agent string, browser language and window size
  • the session identifier listed above

The referring-page category describes this document when you accept diagnostics, which may be partway through a journey. It stays the same during navigation within that document, including a diagnostics session rotation, and is recomputed on a new document load. It does not prove the original source of your visit. It adds no browser-storage entry.

It does not record what you type or enter into forms. It takes no screenshots and does not replay your session. Before diagnostics are buffered for sending, it removes recognised sign-in codes and tokens from web addresses, recognised token-shaped values from text, and values in explicitly sensitive fields. These checks reduce accidental disclosure; they do not recognise every possible secret in arbitrary error or console text.

Click tracking. On mait.sh, if you have accepted diagnostics, we also record when you click a sign-in button (Google, GitHub or Microsoft). We record nothing else about your clicks. You can turn click tracking off below and keep diagnostics on. Turning click tracking off takes effect at once. Turning it back on takes effect from your next visit.

This is not a third-party analytics service. We run both the collector and the storage ourselves on our EU servers. Nothing goes to Grafana Labs, an advertising network or an analytics provider. We keep this data for 7 days. Deriving a country from the connection is not a cookie and does not run in your browser. The privacy policy describes it.

If you are signed in, diagnostics on mait.sh, staff.mait.sh and xCAIO are linked to your MAIT account identifier, never to your sign-in provider's identifier. The privacy policy has the details. Your account page also has switches that turn diagnostics (on all three sites) and click tracking (on mait.sh) off for your account, even in a browser where you accepted.

Event pages add no cookie or browser storage; their campaign tags are part of the page address.

Your choices for this site

The diagnostics switch applies to mait.sh, staff.mait.sh and xCAIO in this browser: staff.mait.sh and xCAIO link here as "Privacy choices". Click tracking only exists on mait.sh. Our command-line tools and other products have their own setting on your account page.

Turning diagnostics off here stops diagnostics on the current mait.sh page immediately, including pending startup. Turning them back on after they have stopped on this page requires a reload. If they have not started on this page yet, accepting starts them immediately. The shared choice applies on the next page load on staff.mait.sh and xCAIO; changing it here does not stop an already-open page on either site.

Third-party cookies

We set no third-party cookies. When you choose to sign in, you go to Google, GitHub or Microsoft. They set their own cookies on their own domains under their own policies. We cannot read those cookies, and we set nothing on their behalf.

Our pages load no fonts, scripts or images from third-party servers, so no one else receives a request from your browser when you view our pages.

How to manage cookies

Every major browser lets you block or delete cookies, usually under Settings, Privacy or Security. The sign-in cookies above are what keep you signed in. If you block them, you cannot sign in.

Deleting cookies does not clear localStorage or sessionStorage. To remove the entries listed above, clear this site's data in your browser settings, or use your browser's developer tools. Deleting the mait-diagnostics-consent cookie makes the diagnostics bar ask you again on all three sites. You can also change your answer with the switch above.

Contact

For questions about cookies, see our privacy policy or write to privacy@mait.sh.

For the existing Google, Microsoft and GitHub sign-in links, consented behavior capture also records a bounded provider navigation intent when you activate the link in the same tab. It uses the existing diagnostics transport and records only the provider category and event time with the existing diagnostics context. It does not record the destination address or query, create another browser-storage record, or prove that a provider received a request, authentication succeeded or an account was created. Diagnostics or behavior decline stops these intent observations on the current Portal page; ordinary diagnostics continue when only behavior is declined.

Last updated

November 8, 2026