Cookie and Local Storage Policy

This policy explains every cookie and every piece of browser storage that GPTpostLLM at https://app.oraglegpt.org uses, why it is used, how long it lasts, and what happens if you refuse it. It is published by TRIIVON S.R.L., whose identification data is in Company Identification.

It is short because the answer is short. We set one cookie. It is the cookie that keeps you signed in. There is nothing else.

1. The law this policy is written under

Two rules apply at the same time and both are respected here.

Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice, art. 4 alin. (5). Storing information on your terminal equipment, or gaining access to information already stored there, is permitted only with your consent and only after clear and complete prior information about the purpose of the processing. This is the Romanian implementation of the ePrivacy rule and it applies to cookies, to local storage, to session storage and to any equivalent technique, not only to cookies.

Legea nr. 506/2004, art. 4 alin. (6). That consent requirement does not apply where the storage or access is carried out for the sole purpose of transmitting a communication over an electronic communications network, or where it is strictly necessary in order to provide a service explicitly requested by the user. This is the exemption our single cookie relies on.

GDPR and Legea nr. 190/2018. Where a cookie or storage item also involves personal data, the processing must additionally have a lawful basis, be transparent and be limited to what is necessary. How we handle personal data generally is set out in Privacy Policy and Your Data Protection Rights. The supervisory authority is Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), https://www.dataprotection.ro.

Name	`orbitpost_session`
Purpose	Holds your authenticated session so the application knows the request is yours
Contents	An opaque random session identifier. It is not a JWT, it carries no readable claims, and it contains no personal data in itself
Flags	`HttpOnly`, `Secure`, `SameSite=Lax`
Set by	https://app.oraglegpt.org only. First party
Lifetime	The session expires 12 hours after sign-in in absolute terms, and after 2 hours of inactivity, whichever comes first
Classification	Strictly necessary. Exempt from consent under Legea 506/2004 art. 4 alin. (6)
Shared with anyone	No

HttpOnly means page scripts cannot read the cookie, which limits what a cross-site scripting flaw could steal. Secure means it is only ever sent over HTTPS. SameSite=Lax limits when the browser attaches it to cross-site requests. In addition to the cookie, mutating requests are checked against the request origin, so a hostile site cannot ride on your session.

This cookie is set only after you sign in. Visiting the site without signing in sets no cookie at all.

3. Browser storage the application uses

The application keeps a small amount of interface state in your browser's localStorage and sessionStorage. These are not cookies, they are never sent to the server automatically, and they hold preferences rather than identity.

Kind	What it holds	Why
`localStorage`	Colour theme choice (light or dark), sidebar collapsed or expanded, table column and density preferences, the last workspace you had selected, dismissed state of one-off interface hints	So the interface looks the same when you come back instead of resetting on every load
`sessionStorage`	Transient view state for the current tab, such as an in-progress filter or the step you are on in a multi-step form	So a page refresh does not throw away work in progress within the same tab

These items are read and written by the application in your browser. They are part of providing the application you explicitly asked for by signing in, and they carry no identifier used for tracking. Clearing site data in your browser removes them and the interface simply returns to its defaults.

4. What we do not use

This list is exhaustive and it is a statement of fact about the deployment, not an aspiration.

No advertising or marketing cookies. We run no advertising and we sell no advertising space.
No third-party analytics. There is no Google Analytics, no Plausible, no Matomo, no product-analytics SDK and no session-replay tool. Nothing on the site reports your behaviour to an analytics vendor.
No tracking pixels or web beacons, including in the legal pages.
No social plugins. There are no Facebook, X, LinkedIn or YouTube embeds, share buttons or like buttons anywhere on the site, so no platform receives a request from your browser merely because you loaded a page here.
No third-party fonts, scripts or CDN assets. Assets are served from our own domain, so loading a page does not disclose your IP address to an asset vendor.
No cross-site or cross-device profiling, no fingerprinting, and no data broker relationships.
No email tracking. The Service sends no email at all, so there is no open-tracking or click-tracking to disclose.

Because none of the above exists, there is no consent to collect for it and no vendor list to publish. If that ever changes, this page is updated before the change is deployed and consent is requested at that time in the manner Legea 506/2004 art. 4 alin. (5) requires.

A consent banner exists to obtain consent for storage that is not exempt. The only cookie we set is strictly necessary to deliver the signed-in application you explicitly requested, which is exactly the case that art. 4 alin. (6) exempts, and the interface preferences described in section 3 are part of that same requested service.

Asking you to consent to the only cookie that makes signing in work would be a false choice, because refusing it means the application cannot function. So instead of a banner we publish this page, which is the "clear and complete prior information" limb of the same article. If we ever introduce storage that is not strictly necessary, you will be asked first, the request will be a real choice, and refusing will not degrade anything you already have.

6. These legal pages set no cookies

The pages under the legal section of this site, including the one you are reading, are static documents. They set no cookies, write nothing to local or session storage, load no third-party resources, and run no scripts. They render with JavaScript disabled. You can read every policy we publish without the site storing anything on your device.

7. How to control cookies, and what breaks

You control cookies in your browser, not in our interface. Every current browser lets you block all cookies, block third-party cookies only, allow cookies for specific sites, or delete stored cookies and site data. The controls are usually under Settings, then Privacy or Content settings, and most browsers also offer a private or incognito window that discards everything on close.

You can also delete our cookie at any time by signing out, which invalidates the session on the server as well as removing it from your browser.

The consequence of blocking it is simple and total: you cannot stay signed in. Without orbitpost_session every request looks anonymous, so the application will return you to the sign-in screen after each attempt and no part of the product will work. Blocking local storage instead of the cookie is less severe: you can still sign in and use the product, but interface preferences such as theme and layout will reset on every page load.

Browser controls also let you clear local and session storage, usually described as "site data" rather than "cookies". Clearing it has the effect described in section 3.

8. Changes to this policy

If the set of cookies or storage items changes, this page is updated and the date at the top changes with it. Material changes that introduce non-exempt storage will additionally be accompanied by a consent request before that storage is used.

Questions about this policy, or a request to see what is stored against your account, go to contact@oraglegpt.org. We answer in Romanian or English.

Privacy Policy explains what personal data we process and why.
Your Data Protection Rights sets out your data subject rights and how to exercise them.
Security describes how the application and its data are protected.
Company Identification identifies the company behind https://app.oraglegpt.org.
Terms of Service sets out the language rule for these documents, including why the Romanian version prevails in dealings with consumers.