Cookie notice
This notice explains how OpenApp uses cookies and similar storage when you use the Service. It supplements the Privacy Policy.
Privacy contact: tomer+privacy@openapp.house.
What we set
| Name | Where | Purpose | Duration | Necessary? |
|---|---|---|---|---|
ory_kratos_session |
Dashboard / identity | Keep you signed in (Ory Kratos) | Session / provider default | Yes — login |
oa_access_invite |
Public invite pages | Bind the browser to an active invitation | 1 hour | Yes — invite session |
oa_guest_id |
Public invite / portal | Attribute actions during that invite or portal session (ULID). Not used for advertising | 1 hour (same as the invite cookie) | Yes — scoped to the active session |
i18n_redirected |
Dashboard | Remember UI language | Persistent (first-party) | Functional |
theme |
Dashboard | Remember light/dark preference | Persistent (first-party) | Functional |
oa_create_account_prompt_dismissed |
Dashboard | Remember that you dismissed a signup prompt | Persistent (first-party) | Functional |
Cookies are first-party. We set HttpOnly, Secure, and SameSite=Lax on
oa_access_invite and oa_guest_id. Native apps may send the guest identifier
in an X-Guest-Id header instead of a cookie.
Dashboard localStorage (selected organization, table page size, do-not-disturb
dismissals) is first-party interface state, not advertising storage.
The marketing site itself does not set analytics or advertising cookies.
Legal basis
Strictly necessary cookies (login and the active invite/portal session) are stored because they are required to provide the Service you requested (ePrivacy Directive Art. 5(3) exception for storage that is strictly necessary).
Functional preferences (i18n_redirected, theme, prompt dismissal) remember
choices you make in the product. We do not run a consent banner for these
first-party preferences while they remain non-advertising.
We do not use a one-year cross-invitation guest fingerprint. oa_guest_id
lasts only for the invite/portal session (1 hour).
How to control cookies
You can delete cookies in your browser settings. Blocking the session cookie
will sign you out. Blocking oa_access_invite / oa_guest_id may prevent an
invitation link from working in that browser.
Changes
We may update this notice when we change cookies. The effective date is shown on the published page.