Cookie Policy
DRAFT — not legally binding
DRAFT — pending legal counsel review. Do not rely on this as legal advice.
Last updated: June 2026 · Effective: pending counsel sign-off
This Cookie Policy explains what cookies and similar technologies we use on the Orqelo platform and website, why we use them, and your choices.
1. What are cookies?
Cookies are small text files stored in your browser when you visit a website. They allow the site to remember information about your visit — such as your login session — across page loads.
We also use similar browser storage mechanisms, including sessionStorage and HTTP-only server-side sessions, where relevant.
2. Cookies we use — essential only
We use essential cookies only by default. Essential cookies are strictly necessary for the Service to function — you cannot opt out of them while using the Service.
| Cookie name | Type | Purpose | Lifetime |
|---|---|---|---|
| __Host-access_token | Essential — session | JWT access token for authenticated API calls. HttpOnly, SameSite=Strict. Not accessible to JavaScript. | 15 minutes (auto-refreshed) |
| __Host-refresh_token | Essential — session | Rotating refresh token used to obtain a new access token without re-login. HttpOnly, SameSite=Strict. | 7 days (sliding) |
| tenant_id | Essential — session | Non-sensitive tenant identifier used by frontend to route API requests to the correct workspace. Not HttpOnly (read by JS). | Session / 7 days |
| csrf_token | Essential — security | CSRF protection token. Validated on all state-mutating requests. | Session |
3. No advertising cookies
We do not set, and have no intention of setting, advertising cookies or tracking pixels from third-party ad networks (e.g. Google Ads, Meta Pixel, LinkedIn Insight Tag). We do not engage in cross-site behavioural advertising.
4. Analytics
This website uses Plausible Analytics — a privacy-first, cookieless analytics tool. Plausible does not set any cookies, does not collect personal data, does not track users across sites, and is fully GDPR-compliant without a consent banner.
- No cookies are set by Plausible;
- No cross-site tracking or fingerprinting;
- Aggregate page view counts only — no individual user profiles;
- Data is processed in the EU by Plausible Analytics OÜ (Estonia).
We do not use Google Analytics, Meta Pixel, or any other cookie-based analytics or advertising tracking. Internal server-side telemetry (error rates, latency metrics) is collected without cookies and does not include personal data beyond anonymised IP prefix.
5. Embedded third-party content
Some pages may embed content from third parties (e.g. YouTube videos in documentation). Embedded content may set its own cookies. We will clearly label such embeds before they load where technically feasible.
6. Your choices
Because we use essential cookies only, the standard cookie consent banner does not apply to our current setup. If you wish to block all cookies, you can configure your browser to do so — note that this will prevent you from logging in to the tenant dashboard.
For browsers that support it, we respect the Sec-GPC (Global Privacy Control) signal.
7. Changes to this policy
If we add non-essential cookies in the future, we will update this policy and present a consent mechanism before any non-essential cookies are set.
8. Contact
Cookie questions: legal@orqelo.com