1. Introduction
TheBuildingCloud (“we”, “us”, “our”) operates a cloud platform for managing smart buildings: sites, entrances, access control devices, fire and intruder alarms, parking cameras, video intercom, notice boards, subscriptions, and related integrations.
When you visit our public website, sign in to the dashboard, open an entrance unlock page, answer a video intercom call, or use billing and mapping features, we and selected third parties may store or read information on your device using cookies and comparable technologies.
Cookies are small text files stored in your browser. We also use localStorage (browser storage that is not sent automatically with every request). Both are described in this policy because they serve similar preference and functionality purposes.
2. What are cookies
Cookies are placed on your computer or mobile device when you visit a website. They are widely used to make websites work, keep users signed in, remember preferences, and understand how services are used.
We classify cookies by purpose:
- Strictly necessary — required for security, authentication, and core platform operation.
- Functional — remember choices such as sidebar layout or notification settings.
- Analytics — help us understand usage (production admin app only).
- Third-party — set by integrated providers such as Google, Chargebee, or Pusher.
3. How we use cookies and storage
We use cookies and browser storage to:
- Keep you securely signed in to the admin dashboard, entrance pages, and intercom pages
- Protect against cross-site request forgery (CSRF) on state-changing requests
- Remember UI preferences (sidebar pin state, notification sound, passkey banner dismissal, intercom audio unlock)
- Deliver real-time device events (access logs, fire alarms, automation, intercom signalling) via Pusher
- Process subscription checkout and saved payment methods via Chargebee
- Provide address lookup and map/geolocation features via Google Maps
- Measure admin-app usage in production via Google Analytics
- Support passkey (WebAuthn) and Google sign-in flows
4. First-party cookies we set
These cookies are set by TheBuildingCloud on our own domain (for example
building-manager.test in development or your production host).
| Name | Type | Purpose | Duration |
|---|---|---|---|
thebuildingcloud_session |
Strictly necessary | Laravel session cookie. Identifies your authenticated browser session for the admin dashboard, entrance unlock pages, intercom pages, and API calls made with Sanctum stateful authentication. Stores session data server-side (or in configured session storage); the cookie holds only the session ID. | Default idle lifetime: 120 minutes, or until you sign out / the session expires. Not tied to browser close by default. |
XSRF-TOKEN |
Strictly necessary | CSRF protection token used by our SPA (axios) and WebAuthn/passkey login flows. Helps prevent unauthorised form submissions and API requests from other sites. | Session-based; refreshed with your session. |
remember_web_* |
Functional | “Remember me” cookie set when you choose that option on email/password login, or when you sign in with Google OAuth (which uses persistent login). Allows you to stay signed in across browser restarts without re-entering credentials each time. | Long-lived (typically up to 5 years unless cleared). |
sidebar-pin |
Functional |
Remembers whether the admin sidebar navigation is pinned expanded or
collapsed. Set via resources/js/utils/sidebarPinCookie.js.
|
1 year (SameSite=Lax, site-wide path). |
Session data (not a separate cookie)
During Google sign-in, we temporarily store google_auth_intent (login vs
register) in your server-side Laravel session before redirecting to Google. This value is
removed after the OAuth callback completes.
5. Browser storage (localStorage)
The following items are stored in your browser’s localStorage, not as HTTP cookies. They are not transmitted automatically to our servers on every request; our JavaScript reads them locally to restore your preferences.
| Key | Where used | Purpose |
|---|---|---|
isNotifySoundEnabled |
Admin dashboard (App.vue) |
Stores whether door-access speech/notification sounds are enabled when real-time access events arrive via Pusher. Defaults to enabled unless you turn sounds off. |
passkey_notice_dismissed |
Admin dashboard (PasskeySetupNotice.vue) |
Records that you dismissed the passkey setup recommendation banner so we do not show it again on future visits. |
intercom_audio_unlocked |
Admin dashboard (VideoCallNotification.vue) |
Remembers that you have granted/interacted with browser audio playback for incoming video intercom calls. Browsers require user interaction before playing call audio; this avoids repeated unlock prompts. |
tbc-swagger-theme |
API documentation (/api/documentation) |
Stores your light/dark theme preference on the Swagger UI documentation page only. |
Passkeys (WebAuthn)
If you register a passkey, your device stores the cryptographic credential in the browser or operating system passkey manager (for example Apple iCloud Keychain, Google Password Manager, or a hardware security key). This is not a cookie, but it is device storage used for passwordless sign-in to TheBuildingCloud.
User theme and branding
Your light/dark theme choice and customised colours are stored in your user profile on our servers and applied when you sign in. They are not stored in a persistent browser cookie by default.
6. Third-party cookies and services
When you use certain features, third-party providers may set their own cookies or use similar identifiers. We do not control those cookies directly. Their use is governed by each provider’s privacy policy.
| Provider | Loaded on | Why we use it | Typical cookies / identifiers |
|---|---|---|---|
| Google Analytics | Admin dashboard (production only, vue-app.blade.php) |
Measure traffic and feature usage in the signed-in admin application. | _ga, _gid, _gat and related GA identifiers |
| Google Maps / Places | Admin dashboard (maps.googleapis.com) |
Address autocomplete, geocoding, and map display when managing sites and buildings. | Google may set cookies such as NID, 1P_JAR, and service-specific identifiers |
| Google OAuth | Login / Register (/auth/google/*) |
Optional “Sign in with Google” and Google-based organisation registration. | Google authentication and consent cookies during the OAuth redirect flow |
| Chargebee | Admin dashboard billing / checkout (js.chargebee.com) |
Subscription plans, hosted checkout, saved payment methods, and billing portal. | Chargebee session and fraud-prevention cookies as determined by Chargebee |
| Pusher | Admin dashboard, entrance app, intercom app | Real-time WebSocket connections for live device and platform events, including access control logs, fire alarm relay events, automation triggers, background job status, parking camera events, and intercom call signalling. | Pusher connection/session cookies and identifiers (e.g. pusher-* related storage) |
| Google Fonts | Marketing site layout, API docs | Web typography (fonts.googleapis.com / fonts.gstatic.com). |
Generally minimal; Google may log font requests |
Marketing website chatbot
Our public marketing site includes an AI support chatbot widget. Conversations are sent to
our server at /chatbot/chat. A conversation ID is generated in page memory
for the duration of your visit; it is not persisted in cookies or localStorage by default.
7. Device and building-management platform usage
TheBuildingCloud connects to physical building devices and services. Cookies and real-time connections support monitoring and control — they do not replace device credentials stored securely on our servers.
Real-time device events (Pusher channels)
When you are signed in, the admin dashboard may subscribe to channels such as:
fire-alarm-events— fire alarm IO board and relay statusbm-automation— automation rule triggers (including CCTV-related flows)BM-{channelId}— background export / status jobs for your organisation- Entrance- and intercom-specific channels for live call and access notifications
Pusher maintains a persistent connection while you keep the page open. This requires
network access and may involve third-party cookies or local connection state managed by
the Pusher client library (pusher-js).
Device integrations covered by the platform
Cookie and session usage applies across management of:
- Access control / Easyset devices and entrance permissions
- Fire alarm (Firebird IO) monitoring and events
- Intruder / burglar alarm integrations
- Parking cameras and ANPR-related events
- Video intercom and caller ID users
- Tuya and other IoT device connections configured in your account
Device vendors may operate their own cloud APIs. Data exchanged with those systems is handled under our Privacy Policy and your organisation’s configuration; additional third-party cookies may apply only if you visit those vendors’ websites directly.
8. Entrance and intercom applications
Entrance unlock pages (/unlock-entrance/{id})
The entrance kiosk mini-app loads app-entrance.js. It uses the same Laravel
session and CSRF cookies when authenticated, and connects to Pusher for fire-alarm relay
events that may trigger door behaviour. No Google Analytics or Chargebee scripts are loaded
on this page.
Video intercom pages (/video-intercom/{id})
The intercom mini-app loads app-intercom.js and Pusher for call signalling.
If you use the full admin dashboard to answer calls, audio unlock state is stored in
intercom_audio_unlocked localStorage as described above.
Mobile intercom apps
Native iOS/Android intercom apps distributed via app stores may use device storage, push notification tokens, and session mechanisms separate from this web cookie policy. Refer to the in-app privacy information for those applications.
9. Managing your cookie preferences
You can control cookies and storage in several ways:
- Browser settings — block or delete cookies, or clear site data. Blocking strictly necessary cookies will prevent sign-in and core features from working.
- Sign out — ends your session and clears session-bound authentication (remember-me cookies may persist until deleted).
- Clear localStorage — resets notification sound, passkey banner dismissal, intercom audio unlock, and Swagger theme preferences.
- Google Analytics opt-out — use Google’s browser add-on or your browser’s privacy controls. Analytics loads only in production on the admin app.
- Sidebar pin — toggle the sidebar in the admin UI or delete the
sidebar-pincookie.
For EU/UK users, strictly necessary cookies do not require consent. Functional and analytics cookies may be subject to local consent requirements; contact us if you need assistance with organisation-level compliance configuration.
10. Updates and contact
We may update this Cookie Policy when we add features, integrations, or change how technologies are used. The “Last updated” date at the top will change accordingly.
Questions about this policy or our use of cookies:
- Email: support@thebuilding.cloud
- Support hub: Help & Support
- Privacy Policy: Privacy Policy