Cookie Policy
This Cookie Policy explains which cookies and similar technologies (such as local storage) we use on our websites and in the OTA-Pulse Cloud console, and supplements our Privacy Policy. Last updated: 2026-10-03.
1. Overview
We use only strictly necessary cookies and similar storage. We do not use advertising, tracking or marketing cookies, and our analytics (Plausible) works without cookies and stores nothing on your device (its script only reads technical information needed to send the page view: URL, referrer, screen width). For that reason we do not show a cookie consent banner.
2. Legal Basis (§25 TDDDG)
Under §25(1) of the Telecommunications Digital Services Data Protection Act (TDDDG), storing information on, or reading it from, your device requires your consent. §25(2) No. 2 TDDDG makes an exception where the storage or access is strictly necessary for us to provide a digital service you have expressly requested (for example staying signed in, or remembering your chosen theme). All items below fall under that exception, so no consent is required. Any personal data processed through them is processed under Art. 6(1)(b) or (f) GDPR.
3. Marketing & Documentation Websites
Our marketing website (ota-pulse.com) and documentation (docs.ota-pulse.com) set no cookies. They use local storage only to remember your theme preference.
| Name | Purpose | Provider | Duration | Category |
|---|---|---|---|---|
| theme (local storage, ota-pulse.com) | Remembers your light/dark display choice | OTA-Pulse (first party) | Until you clear browser data | Strictly necessary (requested function) |
| starlight-theme (local storage, docs.ota-pulse.com) | Remembers your light/dark display choice in the documentation | OTA-Pulse (first party, Starlight framework) | Until you clear browser data | Strictly necessary (requested function) |
4. Cloud Console
The signed-in console uses the following first-party cookies and local storage. The cookies are marked HttpOnly (not readable by scripts) and SameSite=Lax, and Secure on HTTPS deployments.
| Name | Purpose | Provider | Duration | Category |
|---|---|---|---|---|
| access_token (cookie) | Authenticates your requests (session token) | OTA-Pulse (first party) | 60 minutes | Strictly necessary |
| refresh_token (cookie) | Renews your session without logging in again | OTA-Pulse (first party) | 7 days | Strictly necessary |
| oauth_session (cookie) | Protects the Sign-In-with-Google handshake against forgery (carries the OAuth state value); only set when you use Google sign-in | OTA-Pulse (first party) | Browser framework default (up to 14 days); contains only the handshake state | Strictly necessary |
| grafana_session and short-lived sign-in cookies (cookie) | Keeps you signed in to the embedded Grafana dashboards, which we host ourselves | OTA-Pulse (self-hosted Grafana, first party) | Per Grafana configuration (session-limited; Grafana defaults apply) | Strictly necessary |
| theme, console:sidebar-collapsed (local storage) | Remember display preferences | OTA-Pulse (first party) | Until you clear browser data | Strictly necessary (requested function) |
| auth-storage (local storage) | Remembers the signed-in user's profile for the console UI | OTA-Pulse (first party) | Until logout or until you clear browser data | Strictly necessary |
| current_organization_id (local storage) | Remembers the organisation you selected | OTA-Pulse (first party) | Until you clear browser data | Strictly necessary |
| soc-auth-last-refresh (local storage) | Coordinates session renewal between browser tabs (contains no credentials) | OTA-Pulse (first party) | Short-lived, overwritten on each renewal | Strictly necessary |
| terminal-narrow-notice-dismissed:* (session storage) | Remembers that you dismissed a notice in the remote terminal | OTA-Pulse (first party) | Until the tab is closed | Strictly necessary (requested function) |
Requests that change data are additionally protected against cross-site request forgery with a request header; this does not use a cookie.
5. Third-Party Technologies
Only on the console's billing/checkout page, and only when you enter a payment method, we load Stripe.js and the payment fields (they are not loaded on login or any other console page) of our payment provider Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.). Stripe's script may set or read identifiers on your device (such as __stripe_mid, valid up to one year, and __stripe_sid, valid about 30 minutes) to process the payment securely and prevent fraud. We consider this necessary to provide the payment function you requested (§25(2) No. 2 TDDDG). Stripe's own privacy information applies.
If you choose Sign-In with Google, you are redirected to Google's website, where Google sets its own cookies under its own responsibility. We do not embed Google content in our own pages. Links to external sites (for example GitHub) are ordinary links; those sites' own policies apply once you follow them.
Our marketing and documentation websites use Plausible Analytics, which works without cookies and stores nothing on your device; its script only reads technical information needed to send the page view (URL, referrer, screen width). See the Privacy Policy. If we add any further technology that requires consent, we will introduce a consent banner and update this page before it goes live.
6. Managing Cookies
You can delete cookies and local storage at any time or block them in your browser settings. Blocking the strictly necessary console cookies will prevent you from staying signed in.
7. Changes
We may update this Cookie Policy if our use of cookies changes. The current version is always published here.
8. Contact
Questions about this Cookie Policy: binaryblack21@gmail.com.