Everything we store
| Name | Type | Purpose | Category | Duration |
|---|---|---|---|---|
__Host-onuri_session | cookie (HttpOnly, Secure) | Keeps you signed in. Holds a random ID; we store only its hash. | strictly necessary | 30 days, renewed while you use the site; deleted when you sign out |
__Host-onuri_csrf | cookie (HttpOnly, Secure) | Protects your account forms from cross-site request forgery | strictly necessary | same as the session |
__Host-onuri_oauth | cookie (HttpOnly, Secure, encrypted) | Holds the one-time security values (state, nonce, PKCE) during "sign in with Google" | strictly necessary | 10 minutes; deleted when sign-in finishes |
__Host-onuri_form | cookie (HttpOnly, Secure) | Anti-forgery token for the public privacy request form | strictly necessary | 1 hour |
onuri_consent | cookie (Secure) | Remembers your cookie choice: categories, policy version, time and a random consent ID | strictly necessary | 6 months |
onuri-theme | local storage | Remembers light or dark theme. Never sent to us. | preferences | until you clear it; removed if you withdraw consent |
__cf_bm and similar | cookie, set by Cloudflare | May be set by our CDN to tell people from bots and protect the site | strictly necessary | up to 30 minutes |
Categories
- Strictly necessary — always on. Without these you can't sign in securely, and the site can't remember that you said no. The law doesn't require consent for them, but we list them anyway.
- Preferences — off until you allow it. Today that's only your theme.
- Analytics — nothing uses this today. The category exists so that if we ever add privacy-friendly analytics, it stays off until you turn it on. We'd update this page and ask you again first.
Your choice
On your first visit a banner offers accept all, reject non-essential and settings. Rejecting is as easy as accepting. Change your mind any time with (also in the footer). We keep a record of each choice for 5 years as proof of consent; it contains a random consent ID, the categories, the policy version, a keyed hash of your IP address and a shortened browser name. When this policy changes in a way that needs new consent, we ask again.
Global Privacy Control
If your browser sends the Global Privacy Control signal, we record that as "reject non-essential" automatically, don't show the banner, and keep analytics off even if you later click "accept all".
Questions: privacy@onurilabs.com. See also the privacy policy.