Cookies Policy — ICDA (Intelligent Community Dialogue Agent)
Effective date: 2026-05-08 Version: 1.0
This Cookies Policy explains how the Intelligent Community Dialogue Agent (ICDA) uses cookies and similar technologies on the web portal and mobile app. It supplements our Privacy Policy and Terms of Service.
ICDA is operated by Wits Mining Institute, Faculty of Engineering and the Built Environment, University of the Witwatersrand, implementing the platform on behalf of the MASTERMINE Project.
Plain-language summary — We only use the cookies we actually need to keep you signed in, keep the platform secure, and remember your basic preferences. We do not use advertising cookies, and we do not sell your data.
1. What are cookies?
Cookies are small text files placed on your device by websites you visit. Similar technologies include localStorage, sessionStorage, and device-side identifiers used by mobile apps. We use the word "cookies" in this policy to refer to all of these.
Cookies can be:
- First-party — set by ICDA itself (icda.app).
- Third-party — set by services we rely on (e.g. our identity provider).
- Session — deleted when you close your browser.
- Persistent — stored until they expire or you delete them.
2. The cookies we use
We group cookies by purpose. Only the Strictly necessary category is set without your consent — it is required for the platform to function. All other categories require your explicit opt-in via the cookie banner.
2.1 Strictly necessary (always on)
These cookies cannot be turned off — without them, sign-in, security, and core features will not work.
| Cookie / storage key | Purpose | Lifetime | Type |
|---|---|---|---|
icda_session | Signed session token used by middleware to verify you are signed in | 1 hour | First-party, HttpOnly |
icda_refresh_token | Renews your session without asking you to sign in again | 7 days | First-party, HttpOnly |
icda_cookie_consent | Stores your cookie-banner choices so we don't ask again | 12 months | First-party |
Keycloak session cookies (KEYCLOAK_SESSION, AUTH_SESSION_ID, KC_RESTART) | Maintain your sign-in with our identity provider | Session / 30 days | Third-party (/iam) |
2.2 Functional (opt-in)
Remember preferences that make ICDA nicer to use.
| Cookie / storage key | Purpose | Lifetime | Type |
|---|---|---|---|
cdp_theme | Light / dark / system theme preference | 12 months | First-party localStorage |
cdp_language | Preferred interface language (en/es/pl/el/fi) | 12 months | First-party localStorage |
cdp_table_filters | Last-used filters on admin tables | 30 days | First-party localStorage |
2.3 Analytics (opt-in)
Aggregated, de-identified usage data that helps us debug and improve ICDA. We do not use Google Analytics or any advertising-grade tracker.
| Cookie / storage key | Purpose | Lifetime | Type |
|---|---|---|---|
cdp_anon_id | Random per-device identifier for crash reports and error logs (no personal data) | 12 months | First-party |
| Server-side request logs | Aggregated request metrics (path, status, latency) | 12 months | Server-side, no client cookie |
2.4 Map tiles (opt-in)
Loading map tiles (via our map-tile provider) may cause your IP address to be sent to that provider. We treat this as analytics-tier consent.
2.5 What we do NOT use
- Advertising or marketing cookies. None.
- Cross-site tracking cookies. None.
- Social-media share trackers. None.
- AI chat API — no client-side cookies. Your AI-chat messages are sent server-to-server (see Privacy Policy §5).
3. Managing your choices
You can change your cookie choices at any time:
- Web — click "Cookie settings" in the footer, or clear the
icda_cookie_consentcookie in your browser. - Mobile — go to Profile → Privacy → Cookies & tracking.
- Browser controls — most browsers let you block or delete cookies in their settings. Note: blocking strictly-necessary cookies will break sign-in.
Withdrawing consent does not affect processing that already happened lawfully before you changed your mind.
4. Do Not Track and Global Privacy Control
ICDA honours the Global Privacy Control (GPC) signal: if your browser sends Sec-GPC: 1, we treat that as a withdrawal of consent for analytics and functional cookies, the same as clicking "Reject all" in the banner.
Browser-level "Do Not Track" signals are not standardised, so we treat them as informational only — please use the cookie banner for a definitive choice.
5. Changes to this policy
We will post material changes in the app and at https://icda.app/legal/cookies, and re-prompt for consent when the change requires it. The "Effective date" at the top reflects the latest version.
6. Contact
Questions about cookies? Email privacy@icda.app with the subject line "ICDA Cookies".