Sandbox draft · No live sales

Cookies and browser storage

Informational draft · Updated 15 September 2026

This notice describes the current landing and Product implementation. OSYLLO has not added advertising pixels or visitor-behaviour analytics to these pages. Browser storage used for account access and interface settings is explained below; it is not all the same as an HTTP cookie.

Not yet a complete launch notice

The operator's legal identity and the final Privacy Notice remain incomplete. Authenticated use, hosted checkout and infrastructure security settings still require a complete deployment-specific check. This draft does not claim that every third-party service is cookie-free and does not replace or amend the currently accepted Terms.

1. Browsing the public pages

The landing uses locally hosted scripts and fonts, without a visitor-analytics or advertising tracker. A fresh anonymous-browser check on 15 September 2026 found no cookies, localStorage or sessionStorage entries on the landing, sign-in page or unsubmitted registration page. This was not a check of a signed-in session or a payment flow.

We do not ask you to accept advertising or analytics cookies that these pages do not use. Ordinary network requests still reveal technical information such as an IP address to the hosting and security services; an absence of cookies is not an absence of personal-data processing. See the draft Privacy Notice.

2. Account access in the Product

Where and who: on app.osyllo.com, the OSYLLO Product uses the Supabase authentication library. These entries are localStorage, not OSYLLO advertising cookies.

osyllo.supabase.auth.v1 stores authentication session information, including tokens, so the application can maintain and refresh your sign-in. It is normally cleared during sign-out or session cleanup. Browser storage has no automatic expiry of its own; server-side token validity and the continued presence of stored data are different things.
Depending on the authentication flow, related entries such as osyllo.supabase.auth.v1-code-verifier, osyllo.supabase.auth.v1-flow-*-code-verifier and osyllo.supabase.auth.v1-flows-code-verifier hold or index verification information used to complete a secure email confirmation or recovery flow. The asterisk represents a flow-specific identifier, not a literal key.

The authentication library normally removes verification entries as flows complete or session cleanup runs. Abandoned or interrupted flows can leave data behind; there is no fixed local expiry timer, and clearing this site's browser data removes remaining entries. This notice does not promise a short automatic deletion period that the current implementation does not enforce.

3. Your display preferences

Theme: osyllo.product.theme.v1 in Product localStorage remembers a theme you select. It has no fixed expiry and remains until replaced or cleared by you or your browser.
Chart view: keys beginning with osyllo:view:v1:live: in Product sessionStorage remember the selected ticker, chart mode, zoom and related presentation settings within a tab or popout. They do not store market observations or authentication tokens. They normally last for that tab's browsing session and are also cleared by the application's account/session reset; a browser's session-restore feature may restore tab data.

These settings support the interface you use; they are not used for advertising profiles. They are separate from account preferences retained on the server, which are covered by the Privacy Notice. Blocking browser storage may prevent persistent sign-in and reset preferences.

4. Security and hosted payment services

Cloudflare provides hosting and network security. Depending on enabled protections and the request, it may issue security or challenge cookies. None were observed in the anonymous checks described above. The exact enabled cookies and lifetimes must be verified for this deployment; Cloudflare's general catalogue is not a list of cookies all OSYLLO visitors receive. See Cloudflare's cookie documentation.

Stripe-hosted checkout is a separate service reached only through an eligible account's checkout action. Its pages can use their own cookies and technical fraud-prevention data; those were not tested in the anonymous public-page audit. See Stripe's cookie policy. Current OSYLLO billing is sandbox-only: do not enter real card or bank details.

5. Clearing data and contacting us

Use Product sign-out and your browser's site-data controls to remove local entries for app.osyllo.com. Clearing this browser's data does not delete your OSYLLO account or server records, and does not by itself revoke sessions on other devices. It can interrupt sign-in, email-link completion or saved view settings.

OSYLLO's selected communication policy is necessary account, security, billing, support and service notifications only, not newsletters or promotional offers. A Terms acceptance is not marketing consent.

Questions and privacy requests can be sent to [email protected]. The final Privacy Notice must identify the legal operator and explain server-side retention and the applicable rights process.