Cookie Policy

Cookies are small text files that websites store on your device when you visit them. They allow the site to remember your actions and preferences over time. We also use similar technologies including localStorage, sessionStorage, and IndexedDB, which function similarly to cookies and are covered by this Policy.

(a) Strictly Necessary — required for authentication, security (CSRF tokens, rate limiting), load balancing, and session management. These cookies cannot be disabled because the Services cannot function without them.

(b) Functional — remember your preferences (theme: dark/light, language: en/zh-HK, last-used workspace, sidebar collapsed state). Disabling these cookies will reduce the quality of your experience but the Services will still function.

(c) Analytics — anonymised usage statistics that help us understand which features are popular, where users encounter errors, and how to prioritise improvements. We use first-party analytics only; we do not share data with third-party analytics providers.

(d) Marketing — set only with your explicit consent, to measure the effectiveness of our advertising campaigns and to show relevant ads. These cookies are set by our advertising partners and are off until you opt in.

(a) `refresh_token` — HttpOnly Secure cookie scoped to the parent domain. 30-day TTL. Used to issue new access tokens without re-authentication.

(b) `sso_token` — HttpOnly Secure cookie scoped to the parent domain. 30-day TTL. Rotated on every cross-product exchange. Enables Single Sign-On across SlashHub products.

(c) `slashone-csrf` — HttpOnly cookie that holds the CSRF token. 24-hour TTL. Used to prevent cross-site request forgery on state-changing endpoints.

(d) `locale` — remembers your language preference (en / zh-HK). 1-year TTL.

(e) `theme` — remembers your dark/light mode preference. 1-year TTL.

(f) `sidebar:collapsed` — remembers the sidebar state in the dashboard. 1-year TTL.

We use localStorage to store the access token (short-lived, 15 minutes) and the user profile, so that the user does not have to log in on every page load. We use sessionStorage to cache the list of linked product accounts (30 seconds TTL) for the cross-product switcher.

You can clear localStorage and sessionStorage from your browser's developer tools at any time. Clearing them will log you out of the Services.

The Services may embed content from, or interact with, third-party services (for example, identity and payment providers, and our advertising partners). These third parties may set their own cookies. We do not control these cookies; please refer to their respective cookie and privacy policies.

You can manage cookies in several ways: (a) use the cookie preferences banner shown on your first visit; (b) adjust your browser settings to block or delete cookies; (c) use private/incognito mode (though this will log you out on every page load).

Note that blocking strictly necessary cookies will prevent the Services from functioning (you will not be able to log in).

Some browsers offer a "Do Not Track" (DNT) header. We respect DNT by default: when DNT is enabled, we do not set analytics or marketing cookies. Strictly necessary cookies (authentication, security) are always set regardless of DNT because the Services cannot function without them.

For questions about this Cookie Policy, contact privacy@slashhub.hk.

Cookie name: `tp_tool_memo`. First-party — set by this website only, never by a third party.

Purpose: to remember the numbers you type into the tools on this site (MPF contribution, 468 continuous contract, annual leave, sick leave, notice period), so the calculator can pre-fill them the next time you open it. It is used for nothing else.

What it contains: amounts, hours, day counts and on/off choices only. No name, no email address, no employee identifier, and never the calculated result.

Lifetime: 180 days, or until you delete it with 「Clear history」 (清除紀錄) on any tool or on the tools page.

Category: functional — strictly necessary for the tools-memory feature. It is not analytics and is not used for advertising, so it is set even when you decline analytics and marketing cookies.

It is removed by clearing site data for this domain in your browser, or by the 「Clear history」 link on any tool.