Cookie policy

A cookie is a small piece of text that a website asks your browser to store and to send back on your next request, so that the site can tell one visit from another.

Cookies are not the only way a site can keep something in your browser, so this page also covers the two items HRMS stores outside cookies, and the offline cache the app keeps. Everything we place on your device is listed below. Nothing is left out.

There are exactly two. Both are set by Broadmate Global from the same address you are reading this on — they are host-only, so they are not shared with any other site or subdomain. Both are marked httpOnly, which means no script running in the page can read them, and both are marked sameSite=lax, which stops them being sent when another site makes a request on your behalf. In production both are also marked secure, so they only travel over HTTPS.

Both cookies are strictly necessary. Neither is used to profile you, to measure your behaviour, or for advertising. Neither is shared with anybody.

The second cookie deserves a sentence of its own, because it is unusual. When you ask us for help with something we cannot reproduce, a Broadmate Global support account can be given temporary access inside your organisation’s account. That access is what hrms_impersonation records. It lasts thirty minutes and it cannot be extended without starting again. Starting a visit requires a reason to be typed in, and that reason is written to your organisation’s audit log as the visit begins; every further entry the visit writes to that log names the support account behind it. A visit can be opened either read-only or with the ability to change things, and which it was is recorded when it starts. It is not set during normal use, and it is never set on an employee’s own device.

No other organisation can set a cookie through HRMS, because no other organisation’s code runs in the page. There is no analytics script, no tag manager, no advertising pixel, no error-reporting SDK, no font loaded from an external network, no embedded video or map, no CAPTCHA and no iframe.

This is enforced by the browser as well as promised by us. The app sends a Content Security Policy that permits scripts only from its own address and inline in its own pages (script-src ’self’ ’unsafe-inline’), limits network connections to its own address (connect-src ’self’), restricts images to the app’s own address and locally generated data (img-src ’self’ data: blob:), loads fonts only from the app itself (font-src ’self’ data:), and forbids the app being framed by any other site (frame-ancestors ’none’). A script loaded from another domain would be blocked rather than silently allowed, and a script that did run inside the page could not fetch from or send data to another server.

These are not cookies. They are never sent to the server, and they stay on the device you are using.

• Your theme choice. One value in local storage recording whether you picked the light or the dark appearance, so the app does not flash the wrong one when it loads.
• The install prompt dismissal. One timestamp in local storage recording the date two weeks after you dismissed the “install this app” prompt, before which it will not be shown to you again.
• An offline cache. A service worker stores the app’s shell — its layout, styles, scripts and icons — so the app opens on a weak connection. It never caches responses from the API, so no attendance record, payslip or employee detail is written into that cache.

Neither stored value identifies you. A theme preference and a dismissal timestamp are the same for everybody who made the same choice. Clearing your browser data removes all three items; the app will simply follow your device’s own light or dark setting again and re-download its shell.

Every major browser lets you see the cookies a site has set, delete them, and block them. The controls are usually under privacy or site settings, and most browsers also offer them for a single site from the padlock icon in the address bar. You do not need our permission to use any of it.

The honest consequence: hrms_session is how the app knows who you are. If you block cookies for this site, or delete that cookie, you will be signed out and you will not be able to sign in again until you allow it. There is no alternative sign-in that works without it. Blocking cookies more generally in your browser, but allowing them for this site, works normally.

You can also end a session from inside the app rather than from the browser. Signing out clears the cookie, and from your own account you can end another session individually or sign out of all your other sessions at once, which is the better option if you have signed in on a device you no longer have.

When your employer subscribes to HRMS, that organisation is the Data Fiduciary for its employees’ personal data: it decides what is collected and it is responsible for telling its own people. Broadmate Global is the Data Processor — we run the software and act on the organisation’s instructions.

The cookies on this page are set by the software itself, so they are the same for every organisation. Your employer cannot add cookies to HRMS, and neither can anyone else. If you are an employee with a question about your data more broadly, your first point of contact is your own employer, not us.

If the cookies change, this page changes with them, and the version date at the top is updated. A new strictly necessary cookie would be documented here before it is used. A cookie that is not strictly necessary would not be set at all until a consent mechanism exists and you have used it.

Questions about this policy, or about anything the app stores on your device, can go to our Grievance Officer at support@broadmate.org or +91 96080 60350. If you need to write to us by post, email us first and we will arrange an address for the correspondence.

More about Broadmate Global is at broadmate.org.