Last updated: July 3, 2026
1. What we mean by “cookie”
This policy covers all small pieces of data we store in your browser to run the Service — cookies proper, but also localStorage and sessionStorage. Under GDPR + the ePrivacy Directive the same consent rules apply to all three, so we treat them the same here.
2. Categories
We split what we store into three categories:
- Strictly necessary— auth session, workspace choice, CSRF token, and the record of your cookie-consent choice. Always on; the site can’t work without them. Legal basis: legitimate interest / contract necessity — no consent required under GDPR + ePrivacy.
- Analytics — product analytics via PostHog (US Cloud) and Google Analytics 4 (Google Ireland Ltd.). PostHog identifies you only by an anonymous visitor id; Google Analytics measures which pages and traffic sources lead to sign-ups. Both load ONLY after you accept this category, and Google Consent Mode stays denied until you do. Legal basis: consent.
- Marketing— Google Ads conversion measurement (Google Ireland Ltd.), used to tell which advertisement led to a sign-up so we don’t pay for advertising that doesn’t work. We do not run retargeting or sell data to anyone. Loaded ONLY after you accept this category, and Google Consent Mode stays denied until you do. Legal basis: consent.
3. What we store
| Name | Purpose | Category | Retention |
|---|---|---|---|
| octonity.auth-token | JWT access token that keeps you signed in to app.octonity.com | Necessary | Session + refresh |
| octonity.refresh-token | Rotates the auth token silently in the background | Necessary | 30 days |
| octonity.cookie-consent.v1 | Remembers your choice from the banner so we don’t re-ask | Necessary | Until you clear browser storage |
| octonity.tenant-slug | Which workspace you last opened, so we route you there on next visit | Necessary | 6 months |
| ph_phc_… (PostHog) | Product analytics — remembers an anonymous visitor id so one visit isn’t counted as several, and so your journey stays joined up between octonity.com and app.octonity.com. Only set after you accept analytics in the banner. | Analytics | 12 months (shared across octonity.com subdomains) |
| _ga / _ga_82BVCE43DD | Google Analytics 4 — distinguishes one visitor from another and keeps a visit joined up between octonity.com and app.octonity.com. Only set after you accept analytics in the banner. | Analytics | 24 months |
| _gcl_au | Google Ads — records which advertisement a visit came from, so a sign-up can be attributed to the ad that produced it. Only set after you accept marketing in the banner. | Marketing | 90 days |
| octonity.gclid.v1 | Browser storage (not a cookie) holding the Google click id from the address bar, so a sign-up weeks later can still be attributed to the advertisement that brought you. Never shared with third parties. | Marketing | 90 days |
| ARRAffinity / ARRAffinitySameSite | Load-balancer session affinity set by Azure App Service | Necessary | Session |
Stripe’s Checkout page (used only when you subscribe or purchase a template) sets its own cookies under stripe.com — see Stripe’s cookie policy. We don’t receive or store those cookies.
4. Changing your mind
You can revoke your consent at any time — clear the site’s storage from your browser and reload; the banner will reappear. We’re building a “Cookie preferences” link in the app footer that opens the banner directly; until then the clear-and-reload path is the reliable way.
5. Do Not Track
We respect the deprecated DNT browser header when set: if DNT: 1 is present we treat it as an analytics-opt-out even if the banner was previously accepted.
6. Changes
We’ll update this page whenever we add or remove a cookie category. Material changes get a 30-day heads-up by email to workspace admins.
7. Contact
Questions about cookies? Email privacy@octonity.com.