MicSer
Cookie Notice
What cookies and similar technologies are
Cookies are small text files placed on your device by a website you visit. Similar
technologies include browser storage mechanisms such as localStorage and
sessionStorage, which websites use to remember information on your device
between page loads without sending it back to a server on every request.
This policy describes the cookies and browser storage that MicSer, the platform operated by Seismocode Inc. (“MicSer”, “we”, “us”), actually sets, based on a direct review of the application's source code and configuration.
Public pages vs. the authenticated application
MicSer's only pages reachable without signing in are the sign-in / sign-up screen, this
Cookie Policy, and a report-verification lookup page (/verify/<report number>).
None of these set any cookie beyond the ones described below, and the report-verification
page sets no cookies at all. Every other screen (projects, datasets, reports, organization
and billing settings) requires an authenticated session and uses the same cookies described
in this policy — MicSer does not use any additional or different cookies once you are
signed in.
How MicSer uses cookies
MicSer uses cookies only to operate the platform: to keep you signed in and to protect state-changing requests from cross-site request forgery (CSRF). MicSer does not use cookies for analytics, advertising, retargeting, or cross-site tracking, and does not sell or share cookie data with advertising networks.
Cookie categories actually used
Every cookie MicSer sets falls into a single category: Strictly Necessary. MicSer does not currently set Functional, Analytics, or Advertising cookies. If that changes in the future, this policy and the accompanying consent experience will be updated first.
Cookies set by MicSer
| Name | Provider | Party | Purpose | Retention | Secure | HttpOnly | SameSite | Category |
|---|---|---|---|---|---|---|---|---|
| sessionid | MicSer (Django session framework) | First party | Keeps you signed in and identifies your authenticated session on each request. | Up to 2 weeks of inactivity (Django default; not overridden in this codebase), or immediately on sign-out. | Yes in production | Yes | Lax | Strictly Necessary |
| csrftoken | MicSer (Django CSRF framework) | First party | Cross-site request forgery protection; the value is echoed back in an X-CSRFToken header on every request that changes data. |
Up to 1 year (Django default; not overridden), refreshed on login. | Yes in production | No — must be readable by the page's own script to attach the CSRF header | Lax | Strictly Necessary |
No language-preference cookie is set (MicSer's current interface is English-only), and no cookie is set for cookie-notice or consent state — that is remembered in your browser's local storage instead (see below), not a cookie.
Browser storage (not cookies)
The authenticated application also uses localStorage and
sessionStorage — first-party browser storage that, unlike cookies, is never
transmitted to MicSer's servers. It only helps the interface remember your preferences
between visits or between tabs:
| Key | Storage | Purpose | Cleared |
|---|---|---|---|
| micser_cookie_notice_dismissed_v1 | localStorage | Remembers that you dismissed the cookie information notice on the sign-in screen. | Manually, or by clearing site data. |
| micser_active_org | localStorage | Remembers which workspace/organization you last had open. | Manually, or by clearing site data. |
| micser_qc_intro | localStorage | Remembers that you dismissed the Quick Check introduction banner. | Manually, or by clearing site data. |
| micser_logout | localStorage | A timestamp broadcast to sign you out of other open tabs when you sign out in one. | Automatically superseded on the next sign-out. |
| admin_last_seen_v1 | localStorage | For staff accounts: remembers which admin console sections you've already reviewed. | Manually, or by clearing site data. |
| micser_hv_view_<dataset id> | sessionStorage | Remembers your HVSR chart view (which criterion is focused) for a dataset within the current tab. | When the browser tab is closed. |
| micser_map_view_<project id> | localStorage | Remembers the map's zoom, center, selection, and floating-panel positions for a project, so it reopens where you left it. | Manually, or by clearing site data. |
| micser_2d_section_<project id> | sessionStorage | Remembers your 2D cross-section view within the current tab. | When the browser tab is closed. |
Third-party technologies
None of the following set cookies readable by MicSer. They are listed for transparency because your browser contacts these domains directly, or because MicSer redirects you to them for a specific action you initiate.
- Google Fonts (
fonts.googleapis.com,fonts.gstatic.com) — loads the Poppins and JetBrains Mono typefaces used throughout the interface. Loaded on every page. Google does not set a cookie for this, but your browser's IP address is visible to Google when the font files are fetched. - unpkg.com — serves the React, ReactDOM, Babel Standalone, and Leaflet libraries the interface is built with. Loaded on every page.
- cdn.jsdelivr.net — serves the Three.js library used for a 3D basin visualization. Loaded on every page.
- OpenStreetMap contributors (
*.tile.openstreetmap.org) and Esri / ArcGIS Online (server.arcgisonline.com) — serve map tile images when you open the Map module inside a project. Only contacted if you use that feature. - Google (
accounts.google.com) — only if you choose “Sign in with Google”; you are redirected to Google's own sign-in page, governed by Google's own cookie and privacy practices. - Stripe (
checkout.stripe.com,billing.stripe.com) — only if you start a plan upgrade or open “Manage Billing”; you are redirected to Stripe's own hosted payment pages, governed by Stripe's own cookie and privacy practices. MicSer's own pages never embed Stripe scripts or Stripe cookies. - Amazon Web Services (S3) — in production, your browser uploads dataset files directly to a private S3 bucket using a short-lived, pre-signed link generated by MicSer. This is a direct file transfer, not a cookie.
How to manage or withdraw
Because MicSer only sets strictly necessary cookies, there is nothing to opt out of within
the product — a working sign-in requires the sessionid and csrftoken
cookies described above. You can still control cookies at the browser level (see below), and
you can dismiss the informational cookie notice shown on the sign-in screen at any time; it
will not reappear on that device unless the notice's own version changes (for example, if
MicSer later introduces a non-essential cookie and needs to ask for your choice).
Browser controls
Most browsers let you view, delete, and block cookies through their settings. Because
sessionid and csrftoken are required for sign-in to work, blocking
or deleting them will sign you out and prevent you from submitting forms until they are
restored.
Consequences of disabling strictly necessary cookies
If your browser blocks MicSer's cookies, you will not be able to sign in, and pages that submit data (uploading a dataset, saving a project, inviting a member) will fail with a security error, since the CSRF cookie could not be verified.
Changes to this policy
We may update this Cookie Policy as the platform changes. Material changes — such as introducing a new category of cookie — will update the version number above and, where applicable, the informational notice you see on the sign-in screen.
Contact
Privacy enquiries: privacy@seismocode.com
Legal enquiries: legal@seismocode.com