1. Cookies vs. Local Storage
GoValidate LLC's Data Quality, Reconcile, and Editor tools use browser-based local storage and the Origin Private File System (OPFS) to process raw file contents locally. That local-file claim applies to those three browser tools; Validation Lock and account services are hosted and can send the metadata described in the Privacy Policy.
2. Browser Storage & Data Buffers
We use the following client-side technologies to make the validation workspace functional:
- Origin Private File System (OPFS): Data Quality, Reconcile, and Editor may use the browser's OPFS to keep file-processing data locally, including for large files. These tools do not upload raw rows for those checks, though they may send limited metadata as described in the Privacy Policy. OPFS data is stored in your browser profile and can be cleared with the browser's site-data controls.
- LocalStorage: We store workspace state configurations, user display preferences, and feature flags in your browser's local storage. This allows us to restore your active workspace state when you return. LocalStorage is persistent but can be deleted through your browser settings.
- SessionStorage: Used to maintain temporal state objects (such as current navigation references) within a single tab session. SessionStorage is automatically cleared when you close your browser tab.
3. Tracking Cookies & Telemetry Session Identifiers
The browser tools use local storage for workspace state and an analytics identifier. Sign-in, operator access, and Stripe Checkout also use cookies as described below:
- Anonymous Identity Key: The app stores the analytics identifier val_anon_id in localStorage to distinguish anonymous browser activity. The app sets no expiration for this value; it remains until you clear the site's browser data. After the server confirms a deletion request, the Privacy page's control removes its fv_* keys, val_anon_id, and session keys.
- Sign-in and operator sessions: Microsoft Entra ID handles sign-in, and Azure Static Web Apps issues the app's authentication session cookie. The operator analytics dashboard also uses the gv_analytics_session cookie for staff dashboard sessions only.
- Third-party requests and protections: Stripe Checkout may set Stripe cookies during payment. Google Fonts is loaded from Google, and the font request sends your browser IP address to Google. The app checks the Origin header for CSRF protection and does not set a CSRF cookie.