Cookie Policy
This is an informative English translation of the Spanish original. If there is any discrepancy, the Spanish version prevails.
Types of cookies we use
Strictly necessary to provide the service you request: keeping your session, protecting forms and detecting fraudulent access. They do not require consent (art. 22.2 LSSI) and the Platform does not work without them.
accessToken
Keep you logged in. Not accessible from JavaScript.
refreshToken
Renew the session without asking for your password again.
XSRF-TOKEN
Protect forms against cross-site request forgery (CSRF).
legai_cookie_consent
Remember which categories you have accepted or rejected, so we don't ask you again.
oauth_flow_origin
Remember whether you came in with Google or Microsoft from sign-up or from login, to send you back to the right place.
oauth_signup_token
Hand over the social sign-up data without exposing it in the browser address. Single use.
reg_flow
Check that whoever activates two-step verification is the same browser that created the account, so we can let you in without asking for your password again. Single use and not accessible from JavaScript.
oauth2_link_user_id
Link your account with an external identity provider.
client_device_fingerprint
Detect access from unrecognised devices. This is security, not advertising tracking.
legai-stepup-intent
Keep the additional verification that is requested before sensitive operations.
legai-stepup-token
Prove that you have passed that additional verification.
__cf_bm and similar
Tell people from robots on public forms. The form cannot be submitted without it.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
| accessToken | Keep you logged in. Not accessible from JavaScript. | 15 minutes | TributAI |
| refreshToken | Renew the session without asking for your password again. | 30 days | TributAI |
| XSRF-TOKEN | Protect forms against cross-site request forgery (CSRF). | Session | TributAI |
| legai_cookie_consent | Remember which categories you have accepted or rejected, so we don't ask you again. | 2 years | TributAI |
| oauth_flow_origin | Remember whether you came in with Google or Microsoft from sign-up or from login, to send you back to the right place. | 5 minutes | TributAI |
| oauth_signup_token | Hand over the social sign-up data without exposing it in the browser address. Single use. | 5 minutes | TributAI |
| reg_flow | Check that whoever activates two-step verification is the same browser that created the account, so we can let you in without asking for your password again. Single use and not accessible from JavaScript. | 45 minutes | TributAI |
| oauth2_link_user_id | Link your account with an external identity provider. | 5 minutes | TributAI |
| client_device_fingerprint | Detect access from unrecognised devices. This is security, not advertising tracking. | 5 minutes | TributAI |
| legai-stepup-intent | Keep the additional verification that is requested before sensitive operations. | 10 minutes | TributAI |
| legai-stepup-token | Prove that you have passed that additional verification. | 5 minutes | TributAI |
| __cf_bm and similar | Tell people from robots on public forms. The form cannot be submitted without it. | Set by Cloudflare | Cloudflare |
More information
Gestiona tus preferencias
Puedes cambiar tu configuración de cookies en cualquier momento.