01 What cookies are
A cookie is a small text file a website stores on your device so it can remember something about you the next time you visit. Some cookies are useful. They are what let a website keep you signed in between pages, or remember you ticked "stay logged in" last week. Others are used to track you around the web, and that is what gives cookies a bad name.
Technically, the law also treats similar things like local storage, session storage, ETags, and device fingerprints the same way. So when we say "cookies" here, we mean all small pieces of data a site stores in your browser, not just the things formally called cookies.
Lab Nexa uses a very small number of them, all first party (set by our own domain, not by anyone else), all with specific jobs. We will list every one of them below.
We use four cookies. Three of them are required for the site to work at all. The fourth is the one you opt into when you tick "stay logged in". That is the whole story.
02 The four we use
Here is every cookie Lab Nexa sets, what it does, how long it lives, and whether you can refuse it. The honest answer to "can you refuse?" matters, so we included it for each one.
| Name | What it does | Lifetime | Type | Can you refuse? |
|---|---|---|---|---|
PHPSESSID |
Links the pages you visit in one browser session so you stay signed in as you move around. | Until you close the browser | Strictly necessary | No. The site cannot work without it. You can delete it, but you will be signed out the moment you do. |
remember_token |
Lets you tick "stay logged in" on your own device, so you do not have to type your password every visit. | 30 days | Consent based | Yes. Just do not tick the box when you sign in. You can also clear it at any time from your browser. |
device_fingerprint |
Binds that remember token to your device. A stolen token is useless on a different machine. | 30 days idle, then gone | Strictly necessary | No. It is what makes the remember token safe. It contains no personal data, only a hashed mix of browser traits. |
csrf_token |
A single use code attached to every form, so attackers cannot trick your browser into submitting things on your behalf. | Until you close the browser | Strictly necessary | No. It protects you. Without it, any site on the web could make your browser submit forms to Lab Nexa. |
Hashed, not readable
The remember token is hashed before it is stored. If someone got hold of the database, they still could not impersonate you.
Bound to your device
The token is tied to the browser fingerprint of the device that signed in. Stolen from another machine, it is worthless.
Rotated on use
Every time the remember token is used, it is replaced with a fresh one. Even an old token cannot be replayed indefinitely.
Short fuse
30 days, then dead. Convenience should have an expiry date.
03 Why no banner
You probably did not see a cookie banner when you arrived on Lab Nexa. That is deliberate, not missing.
Cookie banners exist because most sites use advertising cookies, analytics trackers, and social media pixels that need your explicit consent before they run. We do not use any of those. Of our four cookies, three are strictly necessary for the site to work at all, and the fourth (the remember token) is only set when you actively tick "stay logged in" on the sign in screen.
So instead of a banner that asks you to pretend to read a list you do not have time for, we just do not have one. This page is here for anyone who wants to know what is actually going on, and it is linked from the footer where it belongs.
If we ever add a cookie that does need consent (say, an analytics opt in), we will add a proper banner at the same time, and this page will explain what is new. Until then, no banner means no surprises.
04 What we do not use
Sometimes it is more useful to say what a cookie policy does not contain. Here is everything we explicitly do not do:
- No advertising cookies. No Google Ads, no Facebook Pixel, no retargeting, no "partners" who show you shoes you looked at last Tuesday.
- No analytics cookies. No Google Analytics, no Hotjar, no Mixpanel, no third party tool watching which buttons you click.
- No social media pixels. No Facebook, X, LinkedIn or TikTok embeds tracking your visit.
- No cross site tracking. We do not share your identifier with any other site, and no other site shares theirs with us.
- No data brokers. We do not buy, sell, or rent lists of users or behaviour.
- No cookie walls. We do not block the site behind a "consent or leave" choice.
- No dark patterns. We will not pre tick "accept all", hide the reject button, or nudge you toward accepting.
These promises are part of what Lab Nexa is. If you ever spot an advertising pixel, a Google Analytics script, or a social media tracker on any Lab Nexa page, you have found a bug and we want to know about it. Email labnexatechnology@gmail.com. That is not a complaint address, it is the team that writes the code.
05 Managing cookies
You are in control. Every modern browser lets you view, block, or delete cookies. Here is where to find the settings in the most common ones. We linked to the official help pages so the instructions stay current:
Google Chrome
Settings, Privacy and security, Third party cookies (or "All cookies and site data").
Open help pageMozilla Firefox
Settings, Privacy and Security, Cookies and Site Data, Manage Data.
Open help pageSafari (macOS)
Safari menu, Settings, Privacy, Manage Website Data.
Open help pageSafari (iPhone / iPad)
Settings app, Safari, Advanced, Website Data.
Open help pageMicrosoft Edge
Settings, Cookies and site permissions, Manage and delete cookies and site data.
Open help pageOpera
Settings, Privacy and security, Site settings, Cookies and site data.
Open help pageWhat happens if you block everything
If you set your browser to reject all cookies (including strictly necessary ones), Lab Nexa will not be able to keep you signed in, and forms will not submit. That is not us being stubborn. It is how browsers work. The minimum setting that still lets the site run is to accept first party cookies from our domain and reject third party ones.
What happens if you clear cookies
You will be signed out, and the "stay logged in" token will be gone. That is the only downside. Nothing in your Lab Nexa account is stored in a cookie. It all lives in our database, tied to your account. Clear cookies freely. You are not deleting anything you cannot get back by signing in again.
06 Do Not Track
"Do Not Track" (DNT) is a browser setting that tells sites you would prefer not to be tracked. In practice, most sites ignore it because the standard never became binding.
We honour DNT, but we should be honest about what that means for us: since we do not run any tracking, analytics, or advertising on Lab Nexa in the first place, the practical difference is zero. DNT on or off, the site behaves exactly the same way. Four first party cookies doing the four jobs listed above, and nothing else.
If that changes in future, DNT will continue to be honoured. No analytics or advertising will be loaded for users who have sent the signal.
07 Changes
When we add, remove, or change a cookie, this page changes with it. The date at the top updates, and if the change is material (a new cookie, a longer lifetime, a new purpose), we will also put a notice in app.
The rule we hold ourselves to: if this page ever needs a cookie banner, we will ship one at the same time. A cookie policy that quietly grows new paragraphs is one you should not trust, and we would rather tell you plainly when something changes than let you discover it by accident.
08 Contact
Questions about cookies, or spotted something on our site that should not be there? There is no support desk with a phone tree and hold music. There is one inbox, and the small team that builds this system reads it. Write at 2am and you will get a reply at nine the next working morning, from a person, not an auto responder pretending to be awake.
Privacy and everything else
LabNexa Technologies Sdn. Bhd. · Registration No. 060419020751 · Registered in Malaysia, working remotely
We aim to respond to all legitimate requests within 30 days at the outside. In practice it is days, not weeks. If we ever need longer, we will say so in writing before the deadline, not after.
© 2026 LabNexa Technologies Sdn. Bhd. (060419020751) · All rights reserved.
Print or save a copy if you like. It is your policy as much as ours.