Cookies and Browser Storage Inventory

Enzoft AB operates the RoadScan website and dashboard. This inventory explains the cookies and similar browser storage used by each service, including who provides them, their purposes, the information stored and their storage periods. An asterisk (*) identifies a name pattern.

Open Cookie settings in the dashboard to change or withdraw optional preference consent. Withdrawal does not affect processing lawfully carried out before withdrawal.

Website

The public website uses no cookies and does not save browser preferences. The dashboard has its own cookie settings and storage, described below.

Dashboard login and requested downloads

These first-party cookies support authentication, login security, redirects and downloads you request. Authentication names may include __Secure- or __Host- prefixes; a large authentication token may be split across cookies.

authjs.session-token*

Provider and storage
Enzoft AB; first-party cookie on the dashboard host.
Purpose and information
Maintains your authenticated account session and access information.
Storage period
Browser session. Authentication tokens remain valid for up to 24 hours, renewable during continued use. Some browsers restore session cookies when reopening a previous session.

authjs.csrf-token

Provider and storage
Enzoft AB; first-party cookie on the dashboard host.
Purpose and information
Contains a security token protecting login requests against cross-site request forgery.
Storage period
Browser session.

authjs.callback-url

Provider and storage
Enzoft AB; first-party cookie on the dashboard host.
Purpose and information
Remembers the destination to return to after login.
Storage period
Browser session.

export_download_token

Provider and storage
Enzoft AB; first-party cookie on the dashboard host.
Purpose and information
Contains a short-lived marker allowing the dashboard to detect the start of a requested ZIP download.
Storage period
At most 60 seconds; removed sooner when the application detects it.

Dashboard choices and optional preferences

Optional saved preferences stay off until you consent. Use Cookie Settings in the account menu or on the login page to accept, reject or withdraw preference consent. Rejection clears the saved preferences below; login and interactive maps remain available. The choice cookie itself is necessary to remember your decision.

roadscan_cookie_preferences

Provider and storage
Enzoft AB; first-party cookie on the dashboard host.
Purpose and information
Remembers your optional saved-preference choice, a version number and expiry. This choice cookie is used whether you accept or reject.
Storage period
180 days.

roadscan_view_*

Provider and storage
Enzoft AB; first-party cookies on the dashboard host.
Purpose and information
With your consent, saves selected dates, history intervals and view/filter settings shared between dashboard routes.
Storage period
Browser session; also cleared on sign-out or rejection of optional preferences.

roadscan:module-view:*, roadscan.map.view.v1:*, roadscan.map.style.v1:*

Provider and storage
Enzoft AB; sessionStorage on the dashboard host.
Purpose and information
With your consent, saves filters, map position and basemap style for your dashboard user.
Storage period
Browser-tab session; also cleared on sign-out or preference rejection.

roadscan:map-query-cache:*

Provider and storage
Enzoft AB; sessionStorage on the dashboard host.
Purpose and information
With your consent, caches map-query results. The dashboard can use an in-memory cache without optional browser persistence.
Storage period
Results are normally valid for three minutes. Expired entries are removed when read, or when the tab closes or the application clears them.

roadscan:rle:district-colors:v2

Provider and storage
Enzoft AB; localStorage on the dashboard host.
Purpose and information
With your consent, saves district names and assigned report colours.
Storage period
No fixed expiry; until cleared by the application, browser or user. Rejection of optional preferences removes it.

Cloudflare Turnstile

Cloudflare Turnstile processes browser and connection information to protect dashboard login against bots. It may use security-related browser storage controlled by Cloudflare, separately from optional RoadScan saved preferences. We do not enable its optional pre-clearance cookie (cf_clearance).

Turnstile security storage (provider-controlled)

Provider and storage
Cloudflare; storage within its hosted security challenge. Names and use may vary by challenge and browser.
Purpose and information
Maintains security challenge state and detects automated abuse.
Storage period
Controlled by Cloudflare and the browser. Verification tokens expire after five minutes and are single-use; that expiry is separate from browser-storage and server-log retention.

Dashboard maps and billing

Mapbox provides the requested interactive dashboard maps. Its service identifiers and map caching support map delivery, usage measurement and billing, separately from optional saved preferences. Mapbox identifies its locally stored billing values as necessary for its service. Optional Mapbox performance reporting is disabled.

mapbox.eventData*

Provider and storage
Mapbox software; localStorage on the dashboard host.
Purpose and information
Stores a random identifier, creation timestamp and service-usage/event information used by Mapbox to provide and bill for requested dashboard maps. This is separate from optional saved-preference consent.
Storage period
The identifier is replaced on subsequent SDK use once older than 24 hours. The storage keys have no automatic expiry; they can be removed by the SDK, browser or user. New values may be created when maps are used again.

mapbox-tiles

Provider and storage
Mapbox software; Cache API on the dashboard host, where supported, in addition to ordinary browser HTTP caching.
Purpose and information
Caches map-tile responses for display and reuse when you use the dashboard maps.
Storage period
Freshness follows each map response's cache/expiry headers. Entries are subject to SDK/browser eviction and user clearing. Ordinary browser HTTP caching is controlled by the browser.

Browser controls and personal data

You can also block or delete cookies and other site data in your browser. Blocking essential storage may prevent login or other requested functions.

Browser storage periods are separate from providers' server-side retention. Google, Mapbox and Cloudflare may process and retain personal data outside the EU/EEA. Read section 7 of our privacy policy for international transfers, safeguards and contact details.

Cloudflare describes its security processing in the Turnstile Privacy Addendum.

Contact info@roadscan.ai with questions.