Sign-in and security
The workspace uses a secure, HTTP-only session cookie to keep you signed in. Short-lived cookies protect Google sign-in against forged requests. Each is scoped to the host that sets it, so a visit to the public website does not disclose your workspace session. There are no advertising cookies and no cross-site tracking identifiers.
| Storage | Purpose | Duration |
|---|---|---|
dynodoc_session | Encrypted sign-in session. HTTP-only, SameSite=Lax and Secure over HTTPS. Access tokens are renewed while your account stays active. | 30 days from its last renewal (renewed while your account stays active); cleared on sign-out. Server-side revocation can end it sooner. |
oauth_state, oauth_verifier, oauth_next | Validate a Google sign-in request and its callback, and remember which page to return to. | Up to 10 minutes; removed when the callback is processed. |
forms_pending | Bind the optional Google Forms authorization to the signed-in account. | Up to 10 minutes. |
dynodoc_forms | Encrypted, HTTP-only, read-only Google Forms access token, used only by the import endpoint. | Up to one hour; cleared when you disconnect or sign out. |
The email sign-in link is not a cookie. It is valid for 15 minutes and Dynodoc keeps the page you wanted to reach in local storage briefly so that the link, which opens in a new tab, can return you there.
Preferences on your device
These items remember choices you made. None is sent to an advertiser or used to track you across sites, and the website works without them.
| Storage | Purpose | Duration |
|---|---|---|
dynodoc_theme (cookie), dynodoc.theme | Your light, dark or system choice, applied before the page is painted. The cookie is shared across dynodoc.online subdomains. Set only when you use the theme switch. | Cookie: one year. Local storage: until cleared. |
dynodoc_metrics (cookie) | Remember your performance-measurement choice across subdomains. Set only when you change it on this page. | Up to 180 days. |
dynodoc.workspace-view | List or grid view of your files. | Until cleared. |
dynodoc:sheet:… | The last sheet tab you viewed in a spreadsheet, per file. | Until cleared. |
dynodoc.sheet-size-notice (session storage) | That you dismissed the small-screen spreadsheet notice. | Until the tab is closed. |
dynodoc.light-pages | Your choice to show documents on white pages in night mode. | Until cleared. |
dynodoc.login-next | A same-site page address to return to after an email sign-in link opens in a new tab. | Removed when used; ignored after 20 minutes. |
dynodoc.session-ended | A timestamp that tells your other tabs you signed out. | Until cleared. |
dynodoc.browser-recovery (preference), dynodoc-browser-recovery (IndexedDB) | Optional recovery copies of unsaved edits, only after you enable them in the editor’s File menu. They contain document content: use them only on a trusted browser. | Copies expire after seven days, at the next storage check, and are cleared on sign-out or when you disable recovery. At most 30 copies of 10 MiB each. The preference stays until cleared. |
Offline page and cache
The website and the workspace register a service worker, which makes the workspace installable as a web app. A service worker is a small script your browser keeps for a site and runs in the background. This one does two things. If a page cannot load because the network or the server cannot be reached, it shows a short “You are offline” page. It also keeps copies of the site’s public script, style and font files after first use, so repeat visits start faster. It never stores a page, a document, an API reply, a sign-in response or anything from your account, and it does not make documents available offline. The administration, sign-in link, shared-link, print and add-in pages, and a few technical routes, do not register it.
| Storage | Purpose | Duration |
|---|---|---|
Service worker (/service-worker.js) | Shows the offline page and keeps the public files below. It is not used for tracking. | Until you clear the site’s data or remove the worker in your browser. |
Cache Storage (dynodoc-shell-…, dynodoc-assets-…) | The offline page, two icons, and public script, style and font files. The names carry the build number. | Until you clear the site’s data. The caches of older builds are deleted when a new build takes over. |
Editor add-ins
The add-ins set no cookies. Office add-ins keep their capture queue in IndexedDB (the dynodoc-provenance database) inside the Office web view, and the connection key
only in the pane’s memory. Google add-ons keep the queue and key in Apps Script UserProperties
of the Google user who installed them. None of this is sent anywhere except to Dynodoc when
you push. See the privacy policy for what is held and how to clear
it.
Performance measurements
Dynodoc measures page loads and web vitals to understand speed and responsiveness. A sample holds a random identifier for the current page load, a coarse page category, a metric name and a number. The identifier is not saved in a cookie and is not reused as a visitor identity.
Samples do not include document titles, text, full addresses, search terms, account emails or authentication cookies. They are sent without cookies to the Dynodoc workspace service, stored in PostgreSQL and removed after 30 days. Network infrastructure necessarily receives connection information such as an IP address; server and provider logs are separate from these records.
Page-load counts are not counts of unique people. Do Not Track and Global Privacy Control signals suppress this collection. The samples are not used for advertising or cross-site profiling.
Your preference
Optional performance measurements are enabled for this browser unless a browser privacy signal disables them. Changing this preference affects future measurements; it does not remove samples already received.
Connected services and browser controls
Google, Microsoft, Vercel and other services may apply their own storage and privacy practices when you visit or authenticate with them or use an add-in inside their products. A Google Forms connection is separate from Google sign-in; disconnecting clears its token, and you can also remove Dynodoc’s grant in your Google Account.
You can inspect, block or clear cookies and local storage in your browser settings. Blocking essential sign-in storage prevents signed-in use. Clearing preferences resets the theme and view choices. See the privacy policy for account and content handling, including retention and the operator’s contact details.