Legal document
Cookie Policy
Last updated (Spanish version): 29 October 2026 · In force (Spanish version): immediately
Courtesy translation. This English text is provided for convenience only. The Spanish version is the only binding version and prevails in the event of any discrepancy. Read the Spanish original: Política de Cookies →
Language of this document. This is a courtesy translation into English of the Política de Cookies of principiosvoluntarios.cl, in the version last updated on 29 October 2026, published in Spanish at principiosvoluntarios.cl/cookies. Only the Spanish version is binding. In the event of any discrepancy, inconsistency or difference in interpretation between the two versions, the Spanish version prevails. This translation does not create, modify, add or remove any obligation, commitment or right of any person. References to and quotations from Chilean legislation and other legal instruments are unofficial translations. If the Spanish version is updated, the updated Spanish version prevails over this translation, even before this translation is updated.
On principiosvoluntarios.cl you receive only cookies that are strictly necessary for your session to work properly and, if you choose the interface language, a preference cookie that you set. We explicitly reject all forms of advertising tracking, third-party analytics, sale of data and persistent fingerprinting.
1. Cookies we use
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-authjs.session-token | Securely maintains the signed-in session. | 8 hours |
| __Host-authjs.csrf-token | Protection against CSRF attacks on forms. | Session |
| __Secure-authjs.callback-url | Remembers the page to return to after signing in. | Session |
| ARRAffinity / ARRAffinitySameSite | Routes each request to the same node of the Azure load balancer (sticky session). | Session |
| pv_idioma | Only if you choose the interface language: remembers the language you chose. It contains only ‘es’ or ‘en’, does not identify anyone and cannot be used for tracking. HttpOnly, Secure, SameSite=Lax. | 1 year |
| __Secure-authjs.pkce.code_verifier · __Secure-authjs.state · __Secure-authjs.nonce | Only if you choose to sign in with Google or Microsoft: they protect the OAuth/OIDC authentication exchange against interception and forgery (PKCE, the state parameter and the nonce). | During sign-in (deleted once it is completed) |
All cookies are HttpOnly (not accessible from the browser’s JavaScript), Secure (HTTPS only) and have an appropriate SameSite policy to prevent cross-site use.
The last three cookies are created only if you sign in with an external provider (Google or Microsoft) and disappear as soon as authentication is completed. If you sign in using a magic link sent by email, they are never created. Those three are likewise strictly necessary cookies: there is no tracking or advertising.
The pv_idioma cookie is the only one that is not strictly necessary: it is a preference that you set. It is created only when you choose the interface language, and it is not stored in our database or associated with your account. If you delete it, the interface is shown in Spanish again.
2. What we do NOT do
We explicitly commit NOT to use:
- Google Analytics, Vercel Analytics, Plausible, Mixpanel, Amplitude, Hotjar or equivalent services.
- Advertising or remarketing cookies.
- Pixels from Facebook, LinkedIn, X (Twitter), TikTok or other social networks.
- Persistent browser fingerprinting.
- Sale or transfer of data to data brokers.
- Third-party cookies for advertising personalization.
3. Telemetry without tracking
We keep minimal records on the server for diagnostic and security purposes:
- Azure App Service Logs: server errors, HTTP requests (URL, response code), without user identifiers. Retention: 3 days.
- Diagnostic telemetry (Azure Application Insights, United States): a copy of the server’s errors and warnings and of operating figures of the news system, designed not to contain personal data. It does not include your browser, your operating system, your IP address or the pages you visit, and before it leaves, email addresses, identifiers, IP addresses and the parameters of web addresses are removed from the texts. Retention: 90 days.
- Abuse control (rate limiting): transient counters that limit how often certain actions can be performed. For sending magic links, they are identified by the truncated IP address (IPv4 to /24, IPv6 to /48) or by the domain of the email address, with the address’s local part reduced to a hash; for use of the assistant, posting on the wall, direct messages and downloading your data, by your account’s internal identifier. Neither the full email address nor the full IP address is ever stored. A daily purge deletes the records, which are never kept for more than 48 hours.
These measurements are server-side and do not involve any additional cookies in your browser.
4. Control from your browser
You can block, limit or delete cookies from your browser settings. Each browser has its own guide:
Important: blocking all cookies from this platform will prevent sign-in.
5. Future changes
If in the future we decide to introduce analytics tools (for example, a self-hosted instance of Umami or another privacy-respecting alternative), we will update this policy and notify members at least 30 days in advance of their activation.
6. Contact
If you detect cookies on this platform that are not documented here, write to us at contacto@principiosvoluntarios.cl and we will look into it as soon as possible.
Related documents: Privacy Policy · Terms of Use