Mataki

Cookie statement

Mataki, provided by Scalentric Limited. Version 1.0, in effect from 11 October 2026.

Mataki sets one cookie. It is needed to sign you in, and Mataki sets nothing else in your browser that follows you, counts you or reports on you.

When you sign in to the app, the server sets a cookie named __Host-mataki_s. It holds a random identifier for your sign-in and a secret that changes at least once an hour while you use the app. The server keeps only a one-way hash of that secret.

  • Purpose: to show the server that requests come from your signed-in browser. It is strictly necessary for the service you asked for, so it needs no separate consent.
  • Lifetime: it ends when your sign-in ends, at most 90 days after you signed in. Signing out removes it at once.
  • HttpOnly: scripts on the page, including Mataki’s own, cannot read it.
  • Secure, with the __Host- prefix: the browser sends it only over https, only to usemataki.app, and to no other domain or subdomain.
  • SameSite=Strict: the browser does not send it with requests that start on another website.

Only the app at /app/ and the server addresses under /api/ set or read the cookie. The public pages of the website (the home page, How it works, Security and the legal pages) set no cookie, and a visitor who never signs in receives none.

What Mataki does not set

  • No analytics or statistics cookies.
  • No advertising, retargeting or social media cookies.
  • No preference cookies.
  • No third-party cookies: Mataki loads no scripts, fonts, images or frames from any other company.

Other storage on your device

The app keeps some information in your browser’s storage on the device you use. This storage is not a cookie: it is never sent to the server, and it stays on the device until you remove it.

  • Your assessments, encrypted with a key derived from your password or data passphrase.
  • Your account details, a note of your sign-in (email, a session identifier and its dates) and, if you chose one, your key locked with a four-digit PIN.
  • Your consent records, the device’s own activity log and your settings.
  • The email you last signed in with, so the sign-in form can fill it in.
  • During a single sign-on through your organization, a random value kept only in that browser tab and removed when the sign-in finishes, which proves that the sign-in finishing is the one this tab started.

The app also keeps a copy of its own files so it can work offline. Clearing this site’s data in your browser settings removes all of it, including your assessments, which cannot be recovered afterwards.

Changes

If Mataki ever needs another cookie, this statement will change first, and any cookie that is not strictly necessary will be set only after you agree to it.

Contact

Scalentric Limited, info@scalentric.org.