1. What a cookie is
A cookie is a small piece of text a site asks your browser to store and send back on your next request. It is what lets a site remember that you signed in a moment ago. A session cookie disappears when you close the browser; a persistent one stays until it expires or you delete it.
Everything below is a first-party cookie — set by the site you are on, readable only by it. None of them is shared with an advertising network.
2. Strictly necessary cookies
These make signing in and staying signed in possible. Without them there is no way to be logged into anything, so they are set whenever you use those features and cannot be switched off while you do.
| Cookie | Purpose | Lifetime |
|---|---|---|
| __session | Keeps a library staff member signed in to the librarian dashboard. | Up to 30 days |
| __sa_session | Keeps a platform administrator signed in. | Up to 30 days |
| __lib_pending / __sa_pending | Holds the half-finished sign-in between the password step and the two-factor code. | 5 minutes |
| __active_branch | Remembers which branch a staff member is working at, so the circulation desk does not have to be told twice. | Session |
| training_session | Keeps a Koha Certificate trainee signed in to the course portal. | 14 days |
| patron_session | Keeps a library member signed in to their library’s public catalogue. | 30 days |
| oauth_state / enroll_identity | Single-use values that verify a sign-in or enrolment step came back from where it was sent, and were not forged. | Minutes |
Sign-in cookies are set only when you sign in. Reading the public pages of this site sets none of them.
3. Preference cookies
These remember a choice you made, so you do not have to make it again on every page.
| Cookie | Purpose | Lifetime |
|---|---|---|
| myopac_locale | The language you chose, so the site keeps speaking it. | Up to 1 year |
| ui_theme_id / ui_variant_id | The colour theme and interface style a staff member picked for their dashboard. | Up to 1 year |
4. Measurement cookies
Two cookies support our own measurement of how the sites are found and used. There is no third-party analytics service behind them, no script from another company, and nothing is shared with advertisers.
| Cookie | Purpose | Lifetime |
|---|---|---|
| myopac_sid | A random identifier that groups the pages of one visit together so a single visit is not counted as ten. | 30 minutes |
| myopac_attr | Remembers which link first brought you here — a search result, a newsletter, a colleague’s message — so we can tell which of our pages actually helps. | 90 days |
Neither contains your name, your email address or your IP address. The Privacy Policy explains what the measurement records and what it deliberately does not — your IP address is hashed with a salt that changes daily and never stored.
5. What we do not use
- No advertising or retargeting cookies.
- No Google Analytics, no tag manager, no third-party analytics service.
- No social-network tracking pixels. Links to our profiles are ordinary links.
- No device fingerprinting, and no attempt to recognise you across other companies’ websites.
6. Cookies on your library’s catalogue
A public catalogue we host for a library uses the same short list: a sign-in cookie when a member logs into their account, the language and appearance preferences, and the measurement cookies above. Which of these apply is a matter for the library, since the catalogue is its service — this policy describes what the software is capable of setting.
7. How to control cookies
Every browser lets you see the cookies a site has set, delete them, and block new ones — usually under Privacy or Site settings. You can block ours specifically without affecting other sites, and private browsing discards them when the window closes.
- Block the measurement cookies and the sites work normally. You simply become invisible in our own figures, which is your right.
- Block the preference cookies and the sites work, but forget your language and theme on each visit.
- Block the strictly necessary cookies and signing in stops working — not as a penalty, but because there is nothing left to remember you by between two requests.
8. Changes, and how to ask
If we add a cookie, it is listed here before it ships, and the revision date at the top moves. If you find a cookie on one of our sites that is not in this list, tell us through the contact page — that is a bug in this page and we want to fix it.