We use the minimum we can. Signing in requires one session cookie; remembering your cookie choice requires two browser-storage keys. We set no advertising or profiling cookies, and we run no third-party trackers on this site. Anything that is not strictly necessary loads only after you choose "Accept all" in the banner, and you can change that choice at any time below.
A cookie is a small text file a site asks your browser to store and send back with later requests. Browser local storage does the same job, but stays in your browser and is never transmitted automatically. We use cookies for the session and local storage for preferences, because preferences do not need to travel with every request.
This is the complete list at the date above. If it changes, this table changes with it.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
oc_sid |
Strictly necessary | Keeps you signed in. Contains an opaque random session identifier only — no name, email or password. Set HttpOnly (unreadable by JavaScript), SameSite=Lax and Secure (HTTPS only). |
12 hours, or until you sign out |
cookie_consentlocal storage |
Strictly necessary | Remembers whether you chose "Accept all" or "Necessary only", so the banner does not reappear on every page. | Until you clear it |
cookie_consent_atlocal storage |
Strictly necessary | A timestamp of that choice, so we can show when consent was given and re-ask if our policy materially changes. | Until you clear it |
cs_sidlocal storage |
Strictly necessary | Keeps the app usable across a page refresh in the same tab session. Holds a session identifier, not personal data. | Until you sign out or clear it |
selected_packagelocal storage |
Functionality | Remembers which plan you selected on the pricing page, so the choice survives a refresh. No personal data; you can clear it at any time. | Until you clear it |
Our content-delivery and network-security layer sits in front of this site and may set its own security cookies — typically an anti-bot cookie used to tell real browsers from automated traffic during an attack. These are security cookies, not tracking cookies: they are not used to build a profile of you and are not shared with advertisers. They are set by that provider as a data processor on our instructions.
We do not load Google Analytics, Meta Pixel, advertising networks, session recorders, or any other third-party tracker unless you have opted in — and today none are configured.
If we ever enable analytics, the scripts are held back by default: they are injected only after your stored choice equals "Accept all", and they are removed from the page entirely if you choose "Necessary only". At present no analytics script is configured, so choosing "Accept all" enables nothing extra today. We keep the mechanism so that if we add analytics later, your existing choice is honoured rather than silently overridden.
Server-side logs — request path, status, duration, and IP for security — are not cookies and are described in section 8 of our Privacy Policy.
You can also block or delete cookies in your browser settings. Every major browser lets you do this per site, and private/incognito windows discard them when you close the window. If you block oc_sid, you will not be able to stay signed in — that is the one cookie the service cannot work without.
We honour Global Privacy Control and Do Not Track signals where your browser sends them, in the sense that we serve no advertising trackers regardless of the signal — there is nothing to opt out of.
The session cookie expires after 12 hours or when you sign out. Local-storage keys stay until you clear them, sign out, or clear site data. None of them contain your password, your payment details or your content.
If we introduce a new category of cookie, this table is updated before it is deployed, and any non-essential cookie waits for your consent. Questions about cookies: [email protected] with the subject "Cookie question".