Cookie Policy

Public website

CabNexus is a product of SoftDots Technologies. Its public information and policy pages can be read without an account. The current static website has no content-administration sign-in and does not set authentication cookies. The separate fleet workspace has its own sign-in and storage, described below.

The public website uses no optional audience-analytics scripts, advertising pixels or embedded third-party players. Its fonts, images and videos are served as website assets. Hosting and security infrastructure can still receive IP addresses and ordinary request metadata. Following an external link is separate from loading these pages.

Website theme preference

The appearance selector stores your choice in localStorage under cabnexus-theme. The value is light, dark or system and is used to display the chosen theme, including across visits and tabs. It is not an advertising identifier and is not sent as a cookie.

This preference has no automatic expiry. Changing the selector replaces it; clearing this website’s browser storage removes it. When no saved preference is available the website uses its default dark appearance. The current public pages do not use sessionStorage or IndexedDB.

Fleet sign-in and interface cookies

The separate fleet workspace uses the first-party tm_auth_session cookie for sign-in. It is HttpOnly, uses SameSite=Lax and is marked Secure in production. It identifies a server-side session. Its lifetime is limited by the configured session lifetime, seven days by default, and the remaining refresh-token lifetime; a session can be renewed as tokens rotate. Signing out clears the current cookie and server session. Employer-provisioned access can be explicitly revoked through offboarding. The server rejects revoked credentials even if a browser still holds a cookie; cookie expiry alone is not the offboarding control. Changing employment status, leaving details or the employee’s operational-record flag does not itself disable login or clear this session; login access must be managed separately.

The workspace also uses the sidebar:state cookie to remember whether the navigation sidebar is open, with a seven-day lifetime. These are workspace cookies, not a marketing-website login. Blocking the session cookie can prevent sign-in; clearing a sidebar preference only resets that interface choice.

Fleet preferences, drafts and cached records

Workspace localStorage can contain theme, userId, a cross-tab logout notice named tm_logout, driver-section visibility preferences and the recent-bookings panel display preference. These preference keys have no automatic expiry. They remain until changed, removed by the relevant workflow or cleared in browser settings.

Booking drafts use booking_form_state, booking_transaction_state and user-specific booking_form_ or booking_tx_ keys. Print workflows can use invoicePrintData, cancellationReceiptData and settlementPrintData. These can contain work or personal information and may remain until the workflow clears them or you clear workspace site data. An old-draft warning is not automatic deletion.

API read caches use mem_cache_ keys. Cached reads have a two-minute validity, but stale bytes can remain until replaced or cleared. Workspace sign-out and confirmed server-revocation handling clear the local user reference, token caches, supported dashboard caches, booking drafts and the named print payloads. Browser storage failures or copies already exported require separate handling. Theme and interface preferences can remain. The current browser code does not use IndexedDB.

The fleet deletion-status form uses a request reference and a private status code. The code is sent in a dedicated request header, not a URL or cookie. These controls do not save it in localStorage, sessionStorage or IndexedDB; the lookup form clears its input after each check. Save the code privately if you need to check progress after account access ends.

Backend administration

Backend administration is separate from the public website and the fleet workspace. It uses sessionid for authenticated staff sessions and csrftoken for request-forgery protection. Their framework defaults are 14 days and 52 weeks respectively; CSRF expiry renews when used. These are code defaults, and deployment settings can alter the periods.

Signing out ends the current administration session and removes its session cookie. The CSRF cookie can remain until expiry or browser clearing. Administration localStorage also remembers appearance, sidebar and navigation history through adminTheme, sidebarOpen and commandHistory. These preferences have no automatic expiry in the current code; they remain until changed, removed through the relevant control or cleared as site data.

Services, controls and external links

Configured fleet address search and routing can request Ola Maps, and route views can request OpenStreetMap tiles. Those services receive the network and map information needed for the view. They are separate from advertising analytics on this public website. Following a phone, email, maps, customer or app-marketplace link invokes the selected service’s own practices.

Use your browser’s site-data controls to inspect, block or clear cookies and local storage for the public website and fleet workspace separately. Do not share cookie or token values. On a shared device, sign out, save any work you need and clear workspace data when appropriate. Clearing browser storage does not delete the account or the server’s fleet records.

The current public website does not load optional advertising or audience analytics that need an opt-in selector. If optional tracking is introduced, its disclosures and any required consent and withdrawal controls must be in place before it loads. For privacy or business questions, contact support@softdots.in.