Cookies
MOLOTOK sets five cookies, and each is required for the thing it belongs to to work at all.
| Cookie | What it does | How long |
|---|---|---|
| Sessionmolotok_session | Keeps you signed in. Without it, every page would ask for your password again. | Until you sign out, or the session expires |
| QuickBooks connectionqbo_state | Set only while a QuickBooks connection is being made, to check the reply came back from where the request went. Deleted immediately afterwards. | Minutes |
| Time kioskmolotok_kiosk | Set only on a shared device an admin has paired as a time kiosk, such as a tablet by the shop door. It tells MOLOTOK that device is the kiosk, so the crew can clock in on it. It is never set on your own browser. | A year, or until the kiosk is revoked |
| Sign-in codemolotok_two_step | Set only if you have turned on two-step sign-in, between typing your password and typing the code from your phone, so the second page knows whose code it is. Deleted as soon as you are signed in. | Five minutes at most |
| Trusted devicemolotok_trusted_device | Set only if you tick “Don’t ask for a code on this device for 30 days” when signing in with two-step sign-in. It lets that browser skip the code — never the password. Changing your password, or your two-step setup, stops it working. | 30 days |
There is nothing else
No analytics cookie, no advertising cookie, no cookie that remembers you across other websites, and no cookie set by any other company — because no other company’s code runs here. MOLOTOK loads no third-party scripts at all: no analytics, no tag manager, no chat widget, and nothing that records what you do on the page.
Why there is no cookie banner
A banner exists to ask permission for the cookies that need it. Cookies that are strictly necessary to deliver something you asked for do not need permission, and those are the only five there are. A banner here would be asking you to agree to something that is not happening.
About the fonts
Two of the typefaces are Google’s, but they are downloaded when MOLOTOK is built and served from this server along with everything else. Your browser never contacts Google, and Google is not told that you visited.