1. Scope

This Cookie Policy explains what cookies and similar browser storage MulikaScans places on your device when you visit mulikascans.com, why we use them, and how to control them. It supplements the Privacy Policy, which describes the personal data we process more broadly. Where the two documents differ, the Privacy Policy governs the data itself and this document governs the browser storage.

MulikaScans is operated by IklwaLabs, based in Tanzania. For cookie questions, contact us at privacy@mulikascans.com.

2. What Cookies Are

A cookie is a small text file a website asks your browser to store and send back on later requests. They let a site remember things between page loads — for example that you are signed in, or that you chose the dark theme.

We also use two closely related technologies:

Local storage — data stored by the page under a named key in your browser, readable only by scripts on our origin. We use it for a small number of display preferences.
Session storage — data kept only for the duration of a single browser tab. We do not currently rely on it.

Neither cookies nor local storage can read data from other websites, and none of it is shared with anyone else unless we say so below.

3. Cookies We Set

The table below lists every cookie and stored key the service uses today. No others are set.

Name	Type	Purpose	Duration
`access_token`	Strictly necessary	Holds your signed-in session so you do not have to log in on every page. Set as `HttpOnly`, so page scripts cannot read it.	1 hour, renewed on activity
`refresh_token`	Strictly necessary	Allows the short-lived access token to be renewed without a new sign-in. `HttpOnly`.	7 days
`session`	Strictly necessary	Flask's signed session cookie, used as a secondary authentication fallback and to carry server-side session state.	Until the browser session ends
`ms-theme`	Preferences	Remembers whether you chose the dark or light theme so the page does not flash the wrong colours on your next visit. Stored in local storage.	Until you clear it
`ms-onboard-dismissed`	Preferences	Records that you have dismissed the dashboard setup checklist, so it is not shown again on every visit. Stored in local storage.	Until you clear it
`ms-cookie-consent`	Consent record	Stores the choice you made in the cookie banner — which categories you allowed, and when — so we do not ask again on every page. Stored in local storage, not in a cookie.	Until you clear it

Authentication cookies are marked HttpOnly, SameSite=Lax, and Secure on the production site. They are only sent over HTTPS and are not attached to requests originating from other sites.

4. Consent Categories

The cookie banner groups storage into three categories so you can decide at a level of detail that suits you:

Strictly necessary — the sign-in and security cookies listed above. These are always on. The service cannot function without them, so they are not optional and the banner does not offer a switch for them.
Preferences — display choices such as your theme. Turning this off means your browser forgets those choices between visits, and pages will load with the default theme each time. Nothing is lost.
Analytics — optional browser-based analytics. We do not currently run one. Product analytics run on our servers instead and set no browser cookie, which is why they fall under the Privacy Policy rather than this banner. This category stays off until you allow it, and if we ever enable it in the browser it will never receive your email address, your scan targets, or your scan results.

Choosing Essential only keeps authentication working and switches everything else off. Choosing Accept all turns on all three.

5. How We Use Them

Cookies serve a small number of purposes on MulikaScans:

Authenticating you and keeping you signed in across pages and page loads.
Remembering display preferences such as theme.
Remembering that you have already dismissed setup prompts, so they do not reappear.
Recording your cookie choice so the banner is shown once, not on every page.
Applying rate limits and security controls that protect the service from abuse.

We do not use cookies to build a profile of your interests, to follow you around other websites, or to target advertising. We do not run any third-party advertising or cross-site tracking pixels.

6. Managing Your Consent

You can change your mind at any time without losing your account or your data.

From the site — once you have made a choice, a small cookie button appears in the bottom-left corner of every page. Click it to reopen the preferences panel, change individual categories, and save.
Clearing storage — clearing site data for mulikascans.com in your browser removes the consent record along with your sign-in cookies and saved preferences. The banner will ask again on your next visit.
By email — you can ask us to remove your stored consent record by writing to privacy@mulikascans.com.

Note that withdrawing consent for authentication cookies is not possible, because they are what establishes that you are signed in. You can end the session instead by signing out, which deletes them.

7. Browser Controls

Every major browser lets you view, delete, and block cookies and site data independently of anything on our side:

Chrome / Edge — Settings → Privacy and security → Third-party cookies.
Firefox — Settings → Privacy & Security → Cookies and Site Data.
Safari — Settings → Privacy → Manage Website Data.

Blocking or deleting cookies means you will be signed out and the banner will reappear on your next visit. We cannot restore a session through any other means.

8. Third-Party Cookies

All cookies set by MulikaScans are first-party cookies belonging to our own domain. Third-party providers do not set cookies on our pages, with two limited exceptions that do not involve cookies:

Payment processing — subscription payments are handled by our payment processor, which is contacted directly by your browser. It sets its own cookies under its own domain, and its own privacy policy applies to them. We never receive or store your card details.
Sign-in providers — if you sign in with Google or another external identity provider, that provider's cookies are set on its own domain during the redirect. We receive only the identity details it chooses to send back.

9. If You Decline

Declining optional cookies has no effect on your subscription, your plan limits, or your scan results. The practical effects are limited to convenience:

Essential-only mode works normally — you can register, sign in, run scans, and export reports exactly as before.
Your theme and dismissed prompts are not remembered, so they reset on each visit.
Choosing not to accept cookies at all, in your browser rather than through our banner, will prevent you from signing in, because authentication depends on them.

10. Policy Changes

We may update this policy as the service changes. When we do, we will update the "Last updated" date at the top of this page. If a change introduces new non-essential cookies or storage, we will ask for your consent again through the banner before using them. Continuing to use MulikaScans after a change constitutes acceptance of the updated policy.

Cookie Policy

Table of Contents