Cookie Policy

Effective Date: [Effective date not configured] Version: 1.0 Company: AJTech LLC Privacy Contact: privacy@example.com

This Cookie Policy is a production legal draft intended for review by qualified counsel before launch.

1. Introduction

This Cookie Policy explains how the Orbelyra platform uses cookies and similar browser storage. It should be read with the Privacy Policy and Terms of Service.

2. Strictly Necessary Cookies

The authenticated application uses strictly necessary first-party cookies for secure authentication, session management, CSRF protection, and account security. Current backend cookie names include:

• `mw_session`: an HttpOnly session cookie used to resolve the authenticated server-side session.
• `mw_csrf`: a CSRF token cookie used with the `X-CSRF-Token` request header for cookie-authenticated mutations.

These cookies are required for login, session continuity, secure account actions, staff invitations, account deletion, and other protected workflows.

3. Security and OAuth State

The Service may use short-lived state values, cookies, or server-side records to protect OAuth, email verification, password reset, staff invitation, and session workflows. OAuth state and raw verification or reset tokens should not be treated as general-purpose tracking identifiers.

4. Preferences and Browser Storage

The frontend may use browser session storage or local storage for product functionality, especially in local development and role-switching workflows. Current local storage keys may include safe local demo session data, selected workspace, selected asset, review cache, publishing cache, and locally staged asset references. These values are used for application continuity and do not store OAuth access tokens, refresh tokens, passwords, SMTP credentials, Stripe secrets, or KMS data.

The application may store or display workspace timezone and other workspace settings through backend APIs. Timezone values are IANA identifiers, not advertising identifiers.

5. Analytics Cookies

The current production-style application does not use non-essential analytics cookies. If analytics cookies or similar trackers are introduced, this policy and any required consent controls should be updated before use.

6. Marketing Cookies

The authenticated application does not currently use marketing cookies or advertising trackers. If marketing tracking is introduced on public marketing pages, it should be documented and controlled separately before deployment.

7. First-Party and Third-Party Cookies

Strictly necessary cookies are set by the application domain. Third-party services such as Stripe, Meta, TikTok, Google, YouTube, hosting providers, or email providers may set their own cookies when users visit those services, complete provider authorization, access payment portals, or use third-party pages. Those cookies are governed by the applicable third-party policies.

8. Cookie Duration

Session cookie duration depends on the selected login mode, remember-me setting where available, environment configuration, and security controls. CSRF cookies are tied to the secure session workflow. Local demo session storage is development-only and should not be exposed in production.

9. How Users Can Control Cookies

Users can control cookies through browser settings. Blocking strictly necessary cookies may prevent login, CSRF validation, staff invitation acceptance, account deletion, Socket.io session authentication, OAuth callback processing, or other protected features from working correctly.

10. Changes to This Cookie Policy

We may update this Cookie Policy if cookie usage, storage usage, analytics, marketing tools, authentication behavior, or third-party integrations change.

11. Contact

Questions about cookies or privacy can be sent to privacy@example.com. General support requests can be sent to support@example.com.