Legal and privacy

Cookie Policy

Last updated 26 October 2026

The public Magic Auth website does not set application cookies, use browser storage, or load advertising or analytics trackers. The interactive examples run on your device without sending example inputs to our API. Fonts and other website assets are served from this site.

This policy also describes the storage used when an account service is enabled. Current access is explained on the access and availability page. It complements our Privacy Policy.

1. What cookies and browser storage do

Cookies are small values a website asks your browser to store and return with later requests. Local storage and session storage retain values for a website in your browser. Session storage is normally limited to the current tab session, although browser restoration settings may preserve it.

We use account cookies to complete a sign-in and recognise the authenticated session. They are necessary for the account service you request. They do not give another company access to your identity profile.

2. Account cookies

First-party cookies used by the relevant account service
Cookie and service	Purpose	Duration
`__Host-ma_company_session` Company account	Keeps the authenticated company session on the API host.	One hour, subject to earlier sign-out or revocation.
`__Host-ma_company_ceremony` Company account	Binds a passkey registration or sign-in attempt to the browser that started it.	Up to three minutes; cleared after completion.
`ma_subject_session` Personal account	Recognises the authenticated personal account on the API host.	Browser-session cookie; server validity is limited to one hour.
`ma_subject_ceremony` Personal account	Binds a personal passkey attempt to its browser.	Up to three minutes; cleared after completion.
`ma_admin_session` Administration	Recognises an authorised administrator, limited to administration API requests.	Browser-session cookie; the administration service limits server validity to 15 minutes.
`ma_admin_ceremony` Administration	Binds an administrator's passkey attempt to its browser.	Up to three minutes; cleared after completion.

These cookies use secure connections and are not readable by page scripts. A browser restoring a session cookie does not extend the server's expiry time. The company and personal cookies are used only when those account services become available; browsing the public website does not create them.

3. Browser storage for retries

The account portals use session storage to recognise a repeated checkout attempt. Company entries begin with ma-checkout-operation:; personal entries begin with ma-personal-checkout:. They associate an operation identifier with the relevant purchase so a retry can be handled consistently.

Personal identity renewal entries begin with ma-idv-renewal:. They link a retry identifier to the person and company request, so reopening a check can recover the same operation. Reviewer recovery entries begin with ma-recovery-create: and retain an operation identifier, case reference and invitation expiry within the relevant reviewer and company session.

These entries do not contain identity evidence, invitation secrets, card details, passkey private keys or Vault keys. They remain until the portal removes them or the tab session ends, subject to your browser's restoration behaviour. They are not written by the public marketing pages.

4. Cloudflare and Stripe

Cloudflare delivers this website and may use security cookies if a protection feature is triggered. Their presence and lifetime depend on that feature and configuration. Cloudflare explains these purposes in its cookie documentation. We do not treat every cookie from an infrastructure provider as automatically necessary.

The website also sends Cloudflare network-error-reporting instructions to supported browsers. These can report failed connections and request outcomes to Cloudflare to help diagnose delivery problems. They are separate from application cookies and do not power advertising on this site.

Following an enabled payment link takes you to Stripe's hosted checkout or billing portal. Stripe controls the cookies on those pages, including payment and fraud-prevention functions. Read Stripe's Cookie Policy for its inventory and choices.

5. Your choices

There are no optional marketing-site trackers to accept or reject in this release, so we do not display a consent banner that offers a choice with no effect. Any future optional tracking must have its own explanation and a consent control before it runs, where required.

You can inspect and clear cookies or site storage in your browser settings. Blocking the account cookies prevents sign-in from working. Clearing checkout retry information during a payment may prevent the portal recognising that retry; check the payment status before starting another purchase.

Signing out ends the account session. Clearing browser storage does not cancel a paid membership or erase information held by the service. Contact admin@tsrobotic.com for cookie or privacy questions.