Cookie Policy &
Browser Storage
This unified policy explains cookies and browser storage across the public website, M-Board member platform, M-Chat, and related digital assets of Madhunandan Association. Platform-specific tables apply when an authorised member uses M-Board or the standalone M-Chat app.
- This is a unified Madhunandan Association policy for cookies and browser storage across our public website, M-Board, M-Chat, and related digital assets.
- M-Board and M-Chat use only the cookies and browser storage needed for login, security, PWA behavior, chat reliability, and push controls. No tracking, advertising, or analytics cookies are set by us.
- M-Board uses an
evoting_sessionlogin cookie. M-Chat usesmboard_chat_stateandmboard_chat_authunder the/chat/path so its login stays separate from M-Board. - The remember-me cookie is optional; you choose whether to enable it at login.
- Browser storage is used for security, PWA install state, device-level push notification control, chat drafts, unread markers, conversation cache, media cache, and safe retry of interrupted sends.
- Form drafts are saved only while unsubmitted. Once you submit a form, the draft is deleted immediately. File selections are never saved.
- You can delete saved form drafts, chat drafts, local chat cache, and retry data by clearing browser storage for this site. Server-side account and conversation records are not deleted by that action.
- No third-party cookies are set by M-Board or M-Chat. External services used for selected features may be contacted only when that feature needs them.
- You can clear all cookies and storage at any time through your browser settings with no loss of account data.
What Are Cookies
Cookies are small text files that a website places on your device when you visit it. They are sent back to the server with each subsequent request, allowing the server to recognise your browser across page loads, which is how you stay logged in as you navigate between pages.
M-Board and M-Chat also use browser storage systems such as local storage, session storage, IndexedDB, Cache Storage, and, where supported, the browser's origin-private file system. Unlike cookies, these storage areas are not automatically sent to the server with every request. They are used for client-side security checks, PWA install state, push-notification control, chat drafts, local chat cache, media previews, and safe retry of interrupted sends.
Essential Cookies
These cookies are strictly necessary for the platform to function. Without them, you cannot log in, maintain a session, or use any authenticated feature. They cannot be disabled without breaking the platform entirely.
| Cookie Name | Type | Purpose | Duration | Sent to Server |
|---|---|---|---|---|
evoting_session |
Essential | Main M-Board session identifier. Ties your browser to your authenticated server-side M-Board session. Contains no personal data - just a random identifier. The server-side session may carry internal flags such as MFA state, device-check state, QR login expiry, and a QR-origin flag that prevents a QR-created session from approving another QR login. | Session/idle lifetime (normally cleared on browser close, sign-out, timeout, or QR session expiry) | Yes - M-Board requests |
remember_token |
Essential | Secure remember-me token. Set only if you tick "Remember me" at login and your device passes the device-trust check. The cookie is not issued immediately at login; it is deferred and only issued once the device verification step is completed successfully. If you skip device trust, no remember-me cookie is ever set regardless of the checkbox. Used to automatically restore your session on your next visit without re-entering your password. A SHA-256 hash is stored on the server; the plain token is never stored server-side. | 30 days from last login (or until you sign out or revoke the device) | Yes - on M-Board page loads for auto-login check only |
mboard_chat_state |
Essential | Dedicated M-Chat state session cookie scoped to /chat/. It supports the QR login screen, CSRF validation, QR polling/finalization state, and temporary app state before or during the dedicated chat login flow. |
Session (cleared on browser close, chat logout, or browser cookie clear) | Yes - /chat/ requests only |
mboard_chat_auth |
Essential | Dedicated M-Chat auth-token cookie scoped to /chat/. Set only after a dedicated chat QR login is approved and finalized. The plain token is held in the cookie; the server stores its hash and can revoke it from logout or the QR Login Manager. |
Up to 400 days, unless you log out of M-Chat, revoke the chat session, clear cookies, or the server rejects the session | Yes - /chat/ requests only |
HttpOnly and Secure it cannot be read by JavaScript
and are only transmitted over HTTPS in production. The remember_token cookie is
only issued after device verification is completed ticking "Remember me" at login stores the intent in your session,
but the actual cookie is only set once device trust is confirmed (or skipped without saving).
If you are on a shared device, do not tick "Remember me." You can revoke all active
remember-me tokens from Profile → Device Management at any time. Dedicated M-Chat
sessions can be logged out inside M-Chat or revoked from the QR Login Manager.
Functional Cookies
Functional cookies enable specific platform features beyond normal member login. M-Board currently uses one restricted maintenance cookie for authorised administrative access during maintenance mode. It is not used for tracking or advertising.
| Cookie Name | Type | Purpose | Duration | Sent to Server |
|---|---|---|---|---|
mboard_maint_bypass |
Functional | Maintenance-mode bypass token used only for authorised administrative access when the platform is temporarily closed to normal traffic. | Up to 24 hours, or until maintenance mode is disabled or the cookie is cleared | Yes - M-Board requests during maintenance checks |
Browser Storage
Browser storage includes local storage, session storage, IndexedDB, Cache Storage, and the browser's origin-private file system where available. Unlike cookies, this data is not automatically sent to the server; it is read and written by client-side JavaScript or service workers for the current site.
| Key / Storage Area | Storage Type | Purpose | Duration | Sent to Server |
|---|---|---|---|---|
dv_token_<uid> |
localStorage | Device verification token. A unique 256-bit hex token stored on your device when you choose "Remember this device" after login. Used by the device-guard system to verify that this device is still trusted on every subsequent visit. The matching record in the server's trusted_devices table expires after 90 days; after that, the token is no longer recognised and you will be asked to verify the device again. If the token is revoked early by an administrator (e.g. you report a lost device), the guard detects the mismatch immediately and forces a sign-out. Contains no personal data, just a random hex token. |
90 days from the date the device was registered (or until you sign out and clear storage, or the device is revoked earlier) | No; sent via explicit JavaScript fetch only during device-guard checks (every 5 seconds while active) |
mboard_pwa_authed |
localStorage | PWA returning-user flag. Set to 1 the first time you install M-Board as a PWA app and sign in successfully. Used to direct returning PWA launches straight to the login selector rather than the public landing page. Once set, it persists permanently for that install unless browser storage is cleared. |
Permanent (until browser storage is cleared) | No |
pwa_install_dismissed |
localStorage | PWA install banner dismissal timestamp. Set when you dismiss the "Install M-Board App" banner. Prevents the banner from reappearing on every visit after you have explicitly dismissed it. | Persistent until browser storage is cleared | No |
mboard_camera_nudge_shown |
localStorage | Camera permission nudge flag. Set to 1 after the one-time camera permission nudge banner is shown in the PWA. Ensures the nudge is displayed only once and not on every subsequent page load. |
Persistent until browser storage is cleared | No |
mboard_fcm_token_<uid> |
localStorage | Current-device push token copy. Stores the latest Firebase Cloud Messaging token for your signed-in account on this browser so the platform can detect the device's push state, avoid duplicate registrations, and keep the device preference UI accurate. The authoritative token record remains on the server in user_fcm_tokens. |
Persistent until replaced, disabled, sign-out cleanup, or browser storage is cleared | No - the token is sent to the server only via explicit authenticated JavaScript API calls |
mboard_fcm_disabled_<uid> |
localStorage | Per-device push disable flag. When you turn push off from Profile → Preferences, this key prevents the app from silently re-enabling push on the same device just because browser permission still exists. | Persistent until you re-enable push on the same device or clear browser storage | No |
mboard_push_prompt_dismissed_<uid> |
localStorage | Push prompt snooze timestamp. Records when you click "Not now" on the first-time push-notification prompt so the platform does not ask again on every page load. | Approximately 7 days from dismissal, then replaced if dismissed again, or until browser storage is cleared | No |
mboard_push_prompt_completed_<uid> |
localStorage | Push prompt completion flag. Marks that the first-time push prompt flow has already been completed on this device for the current account. | Persistent until browser storage is cleared | No |
mboard_draft_<formType>_<uid> |
localStorage | Form draft auto-save. Stores the text you have typed into unsubmitted forms (e.g. proposals, feedback, applications) so you can leave the page and return without losing your work. Each draft is keyed by form type and your user ID. File selections are never saved. Once you submit the form, the corresponding draft key is deleted immediately. Drafts not submitted within 2 days are automatically expired and removed on your next visit. | Up to 2 days from last edit, or until the form is submitted, whichever comes first | No; your draft stays on your device only and is sent to the server only when you click Submit |
mboard-chat-draft:<uid>:<conversationId> |
localStorage | Chat composer draft for one conversation. Stores unsent typed message text and formatting state so you can return to the conversation without losing the draft. Cleared when the message is sent, manually cleared, or browser storage is cleared. | Until sent, cleared, or browser storage is cleared | No - sent to the server only if you send the message |
mboard-chat-outbox:<uid> |
localStorage | Chat outbox metadata for messages waiting to send or retry after an interruption. Helps prevent duplicate sends and recover failed sends. Attachment binaries are stored separately in IndexedDB where needed. | Until the message is confirmed, removed, or browser storage is cleared | No - records are read locally and sent through normal chat APIs only when retrying/sending |
mboard-chat-unread:<uid>:<conversationId> |
sessionStorage | Temporary unread-position helper for the current tab. Keeps the unread divider/anchor stable while opening a conversation. | Session (cleared on tab/browser close or when the unread state is cleared) | No |
mboard-chat-cache |
IndexedDB | Shared M-Board/M-Chat chat cache database. Stores conversation snapshots, message snapshots, resource snapshots, media index entries, and sync metadata so chat opens faster and can recover from interrupted navigation. Store names include conversation_snapshots, message_snapshots, resource_snapshots, media_index, and sync_meta. |
Until refreshed, invalidated by the app, or browser storage is cleared | No - cached records are local copies of data already available through authenticated chat APIs |
mboard-chat-outbox-binary |
IndexedDB | Chat attachment retry and media-cache database. Stores attachment payloads for interrupted voice, image, GIF, audio, video, and file sends, plus selected persisted media payloads needed for local preview/retry. | Until the send is confirmed, the cache is cleaned, or browser storage is cleared | No - payloads are uploaded only through explicit authenticated chat send/retry actions |
mboard-chat-cache media files |
OPFS / browser file storage | Where the browser supports origin-private file storage, chat may store cached image/audio/video blobs locally and keep their index in IndexedDB. This improves media preview speed and reduces repeated downloads. | Until refreshed, cleaned, or browser storage is cleared | No |
mchat_pwa_install_completed |
localStorage | M-Chat install-complete marker. Used by the dedicated chat login page to hide the install button after the standalone M-Chat PWA has been installed or accepted. | Persistent until browser storage is cleared | No |
mchat_fcm_token_<uid> |
localStorage | Current-device M-Chat Firebase Cloud Messaging token copy. Helps the standalone app detect push state and avoid duplicate registration. The authoritative token record is stored server-side with client_app = chat. |
Persistent until replaced, deactivated, sign-out cleanup where applicable, or browser storage is cleared | No - sent to the server only through explicit M-Chat push-token API calls |
mchat_push_completed_<uid> |
localStorage | M-Chat push prompt completion marker. Prevents the app from showing the same enable-push prompt repeatedly after completion. | Persistent until browser storage is cleared | No |
mchat_push_dismissed_<uid> |
localStorage | M-Chat push prompt snooze timestamp. Records when you choose "Not now" so the app does not ask again immediately. | About 7 days from dismissal unless replaced sooner, or until browser storage is cleared | No |
mboard-<version> |
Cache Storage | M-Board service-worker cache for app shell and offline/static assets. It does not contain your private account database records. | Until replaced by a newer M-Board cache version, service-worker cleanup, or browser storage clear | No |
mchat-shell-<version> |
Cache Storage | Standalone M-Chat service-worker cache for the dedicated chat shell, manifest, icons, and offline page. It is separate from the M-Board service-worker cache. | Until replaced by a newer M-Chat shell cache version, service-worker cleanup, or browser storage clear | No |
dv_chk_<uid> |
sessionStorage | Device-guard check throttle timestamp. Records the timestamp of the last device-guard verification. The guard runs a check every 5 seconds while you are active on any protected page; this key prevents redundant back-to-back server calls within that interval. Also bypassed immediately on the first page load after a cookie auto-login so the device is re-verified without delay. Cleared automatically when the browser tab or window is closed. | Session (cleared on tab/browser close) | No |
<uid>)
where applicable, so multiple users on the same browser do not share or overwrite
each other's security tokens, drafts, push state, or chat cache entries.
evoting_session), specifically
qr_login, qr_login_exp, qr_session_duration, and an internal flag
that marks this as a QR-origin session and prevents it from being used to approve further QR logins
(chain-session prevention). These are never written to your browser's local storage or as separate cookies.
When the QR session expires the server destroys it automatically and the client is redirected to the login page.Dedicated M-Chat QR login: approving a chat QR login creates the
mboard_chat_auth
cookie under /chat/ and stores only a hash of that token on the server. This chat login does
not use a fixed duration, but it can be ended by logging out of M-Chat, revoking the session from the
QR Login Manager, clearing the cookie, or server-side rejection.QR Login Manager: the Active Devices and Past Sessions tabs in the QR Login Manager fetch live session and audit data from the server on request. No session or audit data is stored in browser cookies, local storage, or session storage; it exists only on the server and is transmitted securely over HTTPS when you view these tabs.
Third-Party Cookies
M-Board and M-Chat set no third-party cookies of any kind. There are no analytics platforms, advertising networks, social media integrations, or external tracking services embedded in this platform.
M-Board loads Google Fonts and Font Awesome icon libraries from CDN servers for display purposes. Your browser makes direct HTTP requests to these servers to download the font and icon files. These providers receive your IP address as a normal consequence of the HTTP request. This is standard web behaviour that we cannot control. However, these providers do not set persistent tracking cookies in the context of M-Board, and no account or identity data is transmitted to them.
If you enable web push notifications, your browser or installed PWA also communicates with Firebase / Google push endpoints to register the device and receive notifications. This does not add third-party advertising or analytics cookies in M-Board, but it is an external technical delivery path required for push notifications to function.
Optional chat features may contact Google Maps/Places, Google Photos, Google Drive, Google Meet/Calendar, or GIF search providers only when you use those features. M-Board and M-Chat do not set third-party cookies for these services. If a selected provider opens its own page, account picker, or popup, that provider may use its own cookies under its own domain and terms.
Cookie & Storage Duration Reference
| Item | Lifetime | Cleared by |
|---|---|---|
evoting_session |
Session/idle lifetime; QR-created M-Board sessions also follow their approved duration | Browser close, signing out, session timeout, QR session expiry, or browser cookie clear |
remember_token |
30 days (issued only after device trust is confirmed) | Signing out, skipping device trust, admin revocation, expiry, browser cookie clear |
mboard_chat_state |
Session | Browser close, M-Chat logout, or browser cookie clear |
mboard_chat_auth |
Up to 400 days unless revoked earlier | M-Chat logout, QR Login Manager revocation, server rejection, expiry, or browser cookie clear |
mboard_maint_bypass |
Up to 24 hours during maintenance mode | Maintenance disabled, expiry, or browser cookie clear |
dv_token_<uid> |
90 days from device registration | 90-day server-side expiry, sign-out (explicit), admin device revocation, browser storage clear |
mboard_pwa_authed |
Permanent | Browser storage clear only |
pwa_install_dismissed |
Persistent | Browser storage clear only |
mboard_camera_nudge_shown |
Persistent | Browser storage clear only |
mboard_fcm_token_<uid> |
Persistent until replaced, disabled, sign-out cleanup, or browser storage clear | Token refresh, push disable action, sign-out cleanup where applicable, or browser storage clear |
mboard_fcm_disabled_<uid> |
Persistent | Re-enabling push on that device or browser storage clear |
mboard_push_prompt_dismissed_<uid> |
About 7 days from dismissal unless replaced sooner | Prompt completion, later dismissal replacement, or browser storage clear |
mboard_push_prompt_completed_<uid> |
Persistent | Browser storage clear only |
mboard_draft_<formType>_<uid> |
Up to 2 days (or until form is submitted) | Form submission (immediate), 2-day expiry, or browser storage clear |
mboard-chat-draft:<uid>:<conversationId> |
Until sent, cleared, or storage is cleared | Successful send, manual/app cleanup, or browser storage clear |
mboard-chat-outbox:<uid> |
Until confirmed, removed, or storage is cleared | Send confirmation, failed-item cleanup, or browser storage clear |
mboard-chat-unread:<uid>:<conversationId> |
Session | Tab/browser close, unread state clear, or browser storage clear |
mboard-chat-cache |
Persistent local cache | App invalidation/refresh, browser storage clear, or browser quota cleanup |
mboard-chat-outbox-binary |
Until send/retry completes, cache cleanup, or storage is cleared | Send confirmation, app cleanup, browser storage clear, or browser quota cleanup |
mchat_pwa_install_completed |
Persistent | Browser storage clear only |
mchat_fcm_token_<uid> |
Persistent until replaced, deactivated, or storage is cleared | Token refresh, push deactivation, sign-out cleanup where applicable, or browser storage clear |
mchat_push_completed_<uid> |
Persistent | Browser storage clear only |
mchat_push_dismissed_<uid> |
About 7 days from dismissal unless replaced sooner | Prompt completion, later dismissal replacement, or browser storage clear |
mboard-<version> / mchat-shell-<version> |
Until replaced by a new service-worker cache or cleared | Service-worker cleanup, app update, browser storage clear, or browser quota cleanup |
dv_chk_<uid> |
Session | Tab or browser close (sessionStorage) |
Your Control Over Cookies
You have full control over cookies and browser storage through your browser settings. Below is a guide to what happens if you clear or block specific items.
- Clearing all cookies you will be signed out of M-Board and M-Chat on that browser. Your account data (profile, votes, messages, conversations, and files) is stored on our servers and is unaffected. You will need to sign in again.
- Clearing local storage your device token, PWA install markers, push-state markers, chat drafts, and local outbox metadata are removed. On your next visit, the device-guard will not find a token and will skip the security check for that session. Your account is unaffected. You may be asked to re-enrol your device depending on your organisation's security settings. If push notifications were enabled on this device, clearing local storage also removes the local push-state markers and may require the device to re-sync its push status.
-
Blocking all cookies M-Board and M-Chat will not function.
The main session cookie (
evoting_session) and dedicated chat cookies are required to maintain login state. Without it, you cannot stay signed in between page loads. - Revoking remember-me sign in to your account and go to Profile → Device Management. You can revoke individual sessions or all remember-me tokens with one click, without clearing your browser.
- Deleting saved form drafts each form that supports draft auto-save has a clear draft button visible while a saved draft is loaded. You can use it to wipe the stored draft for that form without affecting anything else. Alternatively, clearing your browser's local storage removes all form drafts at once. Form drafts also expire automatically after 2 days if not submitted.
- Deleting chat drafts and retry data clearing site storage removes local chat drafts, unread anchors, cached conversation/message snapshots, media cache, and interrupted-send retry data. It does not delete messages or attachments already stored on the server.
- PWA local storage if you uninstall the M-Board or M-Chat PWA, your browser will clear associated local storage automatically on most platforms. You can also clear it manually via your browser's developer tools or storage settings.
- Push notifications to disable push cleanly, use Profile → Preferences for M-Board push, the M-Chat prompt/session controls for M-Chat push where available, and, if needed, your browser or operating system notification settings. Clearing storage alone does not change the browser's permission state.
Policy Changes
This Cookie Policy will be updated whenever new cookies or important browser storage items are added, existing ones are removed, or their purpose changes. The dates at the top of this page will reflect the most recent review and update.
Because M-Board is an internal platform used by a known, invited membership, we will notify members of material changes through the platform's notification system rather than relying solely on passive policy publication.
Contact & Concerns
If you have a question about this Cookie Policy or want to understand exactly what is stored on your device, please contact us through official association channels.
For questions about cookies, local storage, data on our servers, or any privacy concern please reach out via the official association email. We aim to respond within 7 working days.
contact@madhunandan.org.in