Cookie Policy

This Cookie Policy explains how the Honor Flight App ("we", "us") uses cookies and similar technologies. We purposefully keep our use of cookies minimal and limited to what is strictly necessary to deliver secure functionality to Veterans, Guardians, and Hub Operators.

Key Principles

• Essential Only: We do not use advertising, behavioral targeting, or social media tracking cookies.
• No Cross-Site Tracking: We do not follow you across unrelated websites nor embed third‑party tracking pixels.
• Security Focused: Authentication/session cookies are set with security flags (HttpOnly, Secure, SameSite=strict or lax as appropriate).
• Transparency: We list each cookie category, purpose, and typical retention.

What Are Cookies?

Cookies are small text files placed on your device by your browser. They support core functionality like keeping you signed in and protecting your session against misuse.

Cookie Categories We Use

1. Authentication & Session

These cookies (e.g., session token or next-auth session indicators) keep you signed in, manage token rotation, and enforce access controls. Without them, the application cannot function for authenticated areas.

• Name Examples: next-auth.session-token (or framework equivalent), short-lived anti-CSRF token.
• Security Flags: HttpOnly, Secure (in production), SameSite=Strict or Lax.
• Retention: Session or short fixed TTL (e.g., hours) until logout / expiration.

2. CSRF & Security State

Temporary values help prevent replay, fixation, or cross-site request forgery. They contain no personal profile content and rotate frequently.

• Name Examples: csrf-token, ephemeral nonce identifiers.
• Retention: Minutes to a single request lifecycle.

3. Functional (Strictly Necessary)

Minimal preferences (e.g., dismissing a launch banner or acknowledging a legal update) may be stored to reduce friction. These never include sensitive or behavioral data.

• Name Examples: banner-dismissed, legal-version-ack.
• Retention: Until version changes or a short fixed TTL (days to months).

Technologies We Do NOT Use

• No third‑party advertising networks.
• No social media tracking pixels.
• No cross‑site retargeting scripts.
• No fingerprinting libraries.
• No persistent unique tracking outside functional scope.

Managing Cookies

Because we only deploy essential cookies, a granular consent banner is typically not required under most regulations. You can still clear or block cookies in your browser settings, but doing so may sign you out or limit core functionality.

Data Minimization & Security

We avoid storing sensitive personal or operational data directly in cookies. Server-side session stores or tokens reference internal identifiers. All sensitive processing occurs on the server with audited access controls.

Changes to This Policy

We may update this Cookie Policy to reflect platform changes or regulatory guidance. Material changes will be highlighted via banner or version notice. The version above indicates the effective date reference aligned with our Privacy Policy cadence.

Contact

Questions? Email info@honorflight.app.