Last updated: July 3, 2026
1. What we mean by “cookie”
This policy covers all small pieces of data we store in your browser to run the Service — cookies proper, but also localStorage and sessionStorage. Under GDPR + the ePrivacy Directive the same consent rules apply to all three, so we treat them the same here.
2. Categories
We split what we store into three categories:
- Strictly necessary— auth session, workspace choice, CSRF token, and the record of your cookie-consent choice. Always on; the site can’t work without them. Legal basis: legitimate interest / contract necessity — no consent required under GDPR + ePrivacy.
- Analytics — anonymised product analytics via PostHog (US Cloud). Cookieless mode by default: PostHog runs without any persistent identifier. Loaded ONLY after you accept this category. Legal basis: consent.
- Marketing— reserved for future ad-attribution pixels. Currently unused. If we ever enable this we’ll update this policy 30 days before it takes effect. Legal basis: consent.
3. What we store
| Name | Purpose | Category | Retention |
|---|---|---|---|
| octonity.auth-token | JWT access token that keeps you signed in to app.octonity.com | Necessary | Session + refresh |
| octonity.refresh-token | Rotates the auth token silently in the background | Necessary | 30 days |
| octonity.cookie-consent.v1 | Remembers your choice from the banner so we don’t re-ask | Necessary | Until you clear browser storage |
| octonity.tenant-slug | Which workspace you last opened, so we route you there on next visit | Necessary | 6 months |
| ph_phc_… (PostHog) | Product analytics — remembers an anonymous visitor id so one visit isn’t counted as several, and so your journey stays joined up between octonity.com and app.octonity.com. Only set after you accept analytics in the banner. | Analytics | 12 months (shared across octonity.com subdomains) |
| ARRAffinity / ARRAffinitySameSite | Load-balancer session affinity set by Azure App Service | Necessary | Session |
Stripe’s Checkout page (used only when you subscribe or purchase a template) sets its own cookies under stripe.com — see Stripe’s cookie policy. We don’t receive or store those cookies.
4. Changing your mind
You can revoke your consent at any time — clear the site’s storage from your browser and reload; the banner will reappear. We’re building a “Cookie preferences” link in the app footer that opens the banner directly; until then the clear-and-reload path is the reliable way.
5. Do Not Track
We respect the deprecated DNT browser header when set: if DNT: 1 is present we treat it as an analytics-opt-out even if the banner was previously accepted.
6. Changes
We’ll update this page whenever we add or remove a cookie category. Material changes get a 30-day heads-up by email to workspace admins.
7. Contact
Questions about cookies? Email privacy@octonity.com.