Cookie policy
Last updated: 7 November 2026
Draft. Have this policy reviewed by a lawyer before public launch.
mumus only stores what it needs to work in your browser. Usage analytics run only if you agree. There are no advertising or third-party cookies, and nothing tracks you across other websites.
Strictly necessary
These items are needed to provide the service you request (Section 155(4) of Act C of 2003 on electronic communications, Eht.). They don't need consent and can't be switched off.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
__Host-sid | Cookie (first party, HttpOnly, Secure) | Keeps you logged in and protects forms against CSRF | Until you close the browser; ends after 30 minutes without activity or 8 hours at most |
mumus_consent | Cookie (first party, Secure) | Remembers your choice in the cookie banner, so we don't ask on every page | 12 months |
mumus-theme | Local storage | Remembers light, dark or system theme | Until you change it or clear your browser data |
Analytics (only with consent)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
mumus-analytics-session | Session storage | A random ID that groups the events of one browser tab session, so we can see flows such as “board → task → comment” | Deleted when the tab session ends |
With your consent, we measure page views (page type only), clicks on interface elements (an element identifier and the position, never text or input), rage clicks, scroll depth, time on the page and the window size. The data is processed only by us, on our own servers in the EU. It's stored without a user ID, e-mail or IP address and deleted after 90 days. Legal basis: Art. 6(1)(a) GDPR and Section 155(4) Eht.. More in the privacy policy.
Changing your choice
Open “Cookie settings” in the footer of every page (or in the account menu in the app) to accept or withdraw analytics at any time. Withdrawing takes effect immediately and deletes the analytics session ID. Deleting your browser cookies also resets your choice: we'll ask again on your next visit.
Website widget (on our customers' websites)
If a customer puts the mumus widget on their website, it stores nothing for normal visitors. After a reporter signs in with a QR code, it stores mumus-widget:<project> = 1 in that website's local storage (so the button appears again), and the sign-in token (7 days) in the local storage of the mumus frame, which the website itself can't read. Both are strictly necessary for the reporting the person asked for and are removed with "Sign out on this device".
Browser extension
The mumus browser extension sets no cookies on the websites you visit and contains no analytics.
Contact
Questions: [privacy@mumus.app].