clm.mt is operated by Marco Lorenzo Qureshi Grima, sole trader trading as LimitBreakIT, Malta. Contact marco@limitbreakit.com about this notice. This inventory is based on the reviewed source, not a claim that every live browser, identity provider or future deployment has been scanned.
Marketing site: clm.mt
The marketing site sets nothing in your browser until you choose. On your first visit a prompt offers Accept and Reject with equal weight. Until you accept, the site requests nothing from Google and writes no analytics cookie. Reject keeps it that way. You can change your answer at any time with Cookie settings in the footer. Withdrawing stops measurement on that page and deletes the analytics cookies the site can reach. The site serves its own assets; its fonts are packaged at build time using next/font.
| Name / technology | Purpose and when used | Duration / scope | Purpose / classification |
|---|---|---|---|
clm-consent, localStorage | Remember your analytics choice and when you made it, so the prompt does not return on every page | clm.mt origin; asked again after six months or when we change what analytics does | Necessary to record and respect your choice |
_ga, cookie (Google Analytics 4) | Distinguish visitors so page views can be counted; set only after you accept | 13 months; first-party, .clm.mt, SameSite=Lax, Secure | Optional analytics, consent required |
_ga_J6SQ76ETKH, cookie (Google Analytics 4) | Keep the visit (session) state for our analytics property; set only after you accept | 13 months; first-party, .clm.mt, SameSite=Lax, Secure | Optional analytics, consent required |
With consent, the Google tag is loaded from www.googletagmanager.com and sends page addresses, page titles, referrer, approximate location, device and browser details and on-page interactions to Google Analytics. Google states that Analytics does not log or store IP addresses of EU visitors. Advertising storage, Google signals and ad personalisation are switched off. The marketing site has no sign-up or contact forms, and the docs search box runs in your browser without putting your search text in the page address, so no names, email addresses, search text, certificates or credentials are sent. Google is listed in the provider register. If storage is blocked, your choice applies only to the current page and the prompt returns next time. Visiting still exposes request information to the delivery/DNS providers in the register. An HTTP cache, browser history or a visit to an external link is distinct from an application tracking cookie.
Service portal: app.clm.mt
| Name / technology | Purpose and when used | Duration / scope | Purpose / classification |
|---|---|---|---|
clm_session, cookie | Browser authentication after sign-in; not an advertising identifier | 12-hour expiry; host-only, path /; HttpOnly, SameSite=Lax, Secure on the configured HTTPS service | Necessary for requested authenticated access |
clm_sso, cookie | Bind an initiated OIDC sign-in to the requesting browser | 10 minutes; host-only, path /api/v1/auth/sso/; HttpOnly, SameSite=Lax, Secure on HTTPS; cleared during callback | Necessary for requested SSO security |
clm_passkey, cookie | Bind a requested passkey login/registration ceremony to the browser | 5 minutes; host-only, path /api/v1/auth/passkeys; HttpOnly, SameSite=Strict, Secure on HTTPS; cleared when consumed | Necessary for requested passkey security |
theme, localStorage | Remember light/dark after the user chooses a theme; otherwise use operating-system preference | app origin, no automatic expiry; until changed or browser storage is cleared | User-requested preference; exact necessity/exemption and lifetime need counsel review |
clm-sso-org, localStorage | Remember organisation slug when the user starts SSO | app origin, no automatic expiry; until replaced or browser storage is cleared | Convenience preference; do not assume it is covered by the security-cookie exemption |
The localStorage entries are not cookies, but storage/access rules can still apply. Clearing a cookie does not necessarily erase server-side account or audit records, and signing out does not currently promise deletion of saved preferences. Clear the app's site data using your browser settings, especially on shared devices. Blocking all cookies can prevent sign-in, SSO or passkey flows. Removing localStorage can reset the theme and remembered organisation without deleting the service account. An external identity provider may set its own cookies on its own domain; consult that provider's notice.
Consent and future changes
We distinguish essential authentication/security cookies separately from optional tracking. Malta's regulator describes an exemption for storage strictly necessary for a service explicitly requested by the user, not a blanket exemption for every preference. See the IDPC cookie-consent guidance. The automatic persistence of the SSO slug and indefinite preference lifetimes remain part of the closed-pilot onboarding review: remove unnecessary persistence, make “remember” an explicit reviewed choice where appropriate, bound retention, or add a valid consent mechanism if required. The app has no consent prompt because it sets no optional storage.
Optional analytics on the marketing site follows that rule: it loads only after affirmative consent, refusal is one click and as prominent as acceptance, and withdrawal is available from every page. The app at app.clm.mt never loads analytics. If advertising, embedded content or other non-exempt storage is added, update this inventory and obtain valid prior consent before loading it. Review live cookies and network requests again after any CDN/proxy/IdP change.