Cookie Policy

Draft. These terms have not yet been reviewed by counsel and are published for comment. They do not replace the agreement in your pilot contract, which governs where the two differ.

The short version: these marketing pages set no cookies at all, and the application sets exactly one — a random token that keeps you signed in. There is no analytics cookie, no advertising cookie, and no third-party cookie anywhere in the product. That is why you have not been asked to accept anything.

1. Scope

This policy covers the Xorah website at www.xorah.net and the hosted application at app.xorah.net, both provided by Xorah. It sits alongside the Privacy Policy, which governs everything else we handle, and the Terms of Service. Where this page and the Privacy Policy describe the same thing they are meant to agree; if they ever do not, the Privacy Policy governs.

2. What this covers, and why it is short

A cookie is a small file a site asks your browser to store and send back on later requests. It is the mechanism behind staying signed in — and also the mechanism behind most tracking on the web, which is why cookie policies are usually long.

“Cookies” here means more than cookies. Everything below applies equally to the techniques that do the same job under another name: local storage, session storage, IndexedDB, tracking pixels, web beacons, device identifiers, and third-party scripts or tag managers. Saying “we set no cookies” while moving the tracking into local storage would be a lie told on a technicality, so this policy closes that door explicitly.

The page is short because the footprint is small, and the footprint is small for an engineering reason rather than a virtuous one. The review pipeline is built to run offline — it grades a document without making a network call — so the product never needed a telemetry habit. The only state your browser has to hold is whether you are signed in. A cookie table is only interesting when it is long; a reviewer should be able to finish this one in a minute and move on.

3. This website sets no cookies

Every page on this marketing site is a single self-contained file that makes zero external requests. The fonts and styles are embedded in the page itself. There is no analytics tag, no advertising pixel, no session-replay script, no chat widget, no embedded video, no social button, and no consent-management platform — and therefore no cookies of any kind, first-party or third-party.

This is enforced, not intended. The script that builds this site fails the build if a page contains a URL pointing at any host other than our own, so a third-party tag cannot reach production by being added and forgotten.

You do not have to take our word for it. Open your browser's developer tools, load any page on this site, and look at the Network and Application panels: no request leaves the origin, and the cookie jar for this domain stays empty.

4. The application sets one cookie

Signing in to app.xorah.net sets a single cookie. In full:

That is the complete list. There is no second cookie, and nothing is set before you sign in — the login page itself sets nothing. This cookie is strictly necessary in the sense clause 7 uses: without it the application cannot tell one signed-in user from another, and a sign-off could not be attributed to the person who made it.

Two clocks are involved, and they are not the same. The cookie is a browser-session cookie, so your browser drops it when you close it. The session it points at is held on our side and expires 12 hours after sign-in regardless of activity, after which the cookie is worthless even if it survives.

How it is configured, since a reviewer will ask:

• HttpOnly — page scripts cannot read it, which is what stops a cross-site scripting bug from becoming a stolen session.
• Secure — sent over HTTPS only. This is set in the hosted deployment, not merely available as an option.
• SameSite=Lax — not sent on cross-site requests, which blunts cross-site request forgery.
• Server-side and revocable — the cookie holds a random token and nothing else. Only its SHA-256 hash is stored on our side, so a database dump does not hand anyone a live session. Signing out revokes the session on the server, not just in your browser.
• Purged on expiry — expired sessions are deleted rather than left to accumulate.

5. What that cookie is not

The value is a random token. It carries no name, no email address, no organization, no role, and nothing about any document you have uploaded — those live in the database, reachable only after the token has been matched to a live session. Once the session has expired or been revoked, the token is meaningless to anyone who holds it.

It is not used to build a profile, to measure you, or to follow you anywhere. It has one job, and when you sign out it stops having it.

6. What we do not use

An absence is only checkable if you are told what to look for, so, specifically: we use no analytics of any kind (no Google Analytics, no product analytics, no heatmaps, no session replay); no advertising, retargeting or conversion pixels; no A/B testing or feature-flag services; no social-media buttons or share widgets; no chat or support widget; no tag manager; no fingerprinting; and no local storage, session storage or IndexedDB. Nothing on either domain is served by another company, so no third party is in a position to set a cookie in the first place.

The one thing that happens without a cookie is the access log any web server writes — your IP address, the page requested, your browser's user-agent. We describe it, and how long it is kept, in the Privacy Policy. It is not used to profile anyone and it is not joined to anything else.

7. Why there is no consent banner

Under the EU ePrivacy Directive and the UK's PECR (regulation 6(4)), consent is not required for storage that is strictly necessary to provide a service the subscriber has explicitly requested. A cookie whose only function is to keep an authenticated user signed in is the textbook case. Ours is that cookie, and we have nothing in any other category, so there is nothing to obtain consent for and no preference for a banner to record.

We would rather not show you a dialog whose only honest option is “fine”. There is also no cookie-settings panel, for the same reason — a preference centre with one permanently-on switch would be theatre. If that ever changes, clause 11 says what we will do first.

8. Global Privacy Control, Do Not Track, and CCPA

We honour a legally recognised browser opt-out signal, such as Global Privacy Control, in accordance with applicable law — though since we set no analytics or advertising cookies, there is nothing for it to switch off. Do Not Track has no agreed meaning for sites to implement, so like most vendors we do not act on it specifically; the practical answer is the same, because we do not track you across sites or over time with or without a signal.

For the avoidance of doubt under the CCPA/CPRA: we do not sell or share personal information, we have not in the preceding twelve months, and we do not engage in cross-context behavioural advertising.

9. Controlling cookies in your browser

Every major browser lets you view, block and delete cookies, per site or globally, under its privacy or site settings; your browser's own help explains where. Deleting the session cookie signs you out. Using the sign-out button is the more thorough of the two, because it also revokes the session on our side.

You can block cookies for app.xorah.net if you prefer, but the consequence is total: the application cannot sign you in without it. There is no fallback, deliberately — the alternatives, a token in the URL or a token in local storage, are both worse for security. Blocking cookies for www.xorah.net changes nothing, because this site sets none.

10. Third parties

No advertising network, analytics provider or data broker receives anything from this website or the application, because none of them is present in either. The application loads every asset it uses — its stylesheet, its fonts, its scripts — from its own origin, so your browser is never asked to contact another company while you work.

Our infrastructure runs on Amazon Web Services, Amazon Web Services, US East (N. Virginia), which hosts the service but sets no cookies of its own in your browser. AWS is the sole sub-processor named in the Privacy Policy, and that list is complete.

11. Changes to this policy

If we add a cookie or any of the technologies named in clause 2, we will add it to the table above and change the effective date before it goes live — not after. Where a change would require your consent we will ask for it rather than assume it, and a banner would appear at that point. This is the commitment that makes the table worth reading: it is meant to be complete on the day you read it.

12. Contact

Questions about anything on this page, or a request to verify it: legal@xorah.net. See also the Privacy Policy and the Terms of Service.