Cookies and browser storage
This draft describes the browser code reviewed on 9 October 2026. Questions: privacy@orage.ai. The publisher is [Publisher legal name and address], currently Axel Rock acting as an individual. Read the Privacy Policy for legal bases, retention and your rights.
Public site at orage.ai
The site's own page code does not set cookies, use localStorage or keep an analytics identifier between loads. It does not load a PostHog browser SDK, session replay or advertising code.
When a PostHog capture key is configured, each page load sends one page-view request directly to PostHog. Each request has a new random ID. It includes the page origin and path, environment and the browser-supplied referrer. The current page's query and fragment are excluded. The referrer is not stripped by this code and can include a full URL. The request disables person profiles and GeoIP enrichment. The receiving server still sees request metadata, such as the network address. Cookie-free does not mean that a network request is fully anonymous.
The waitlist form posts your email and originating page to Orage's server. It does not need a cookie or script to submit. The server counts the signup without sending your email to PostHog. Vercel and other hosts can also process request logs for delivery and security.
Web app at app.orage.ai
Orage uses first-party cookies for sign-in and secure account connections. It uses browser storage for preferences and playback recovery. These are not advertising identifiers.
| Item | Purpose | Lifetime |
|---|---|---|
orage_session cookie |
Keep you signed in and authenticate app requests | 30 days by default; removed on sign-out or expiry |
orage_github_state cookie |
Bind a GitHub sign-in to the browser that started it | Up to 10 minutes; cleared at callback |
orage_next cookie |
Return to the same app page after sign-in | Up to 10 minutes; cleared at callback |
orage_music_return cookie |
Return from GitHub sign-in to the private music-link flow | Up to 5 minutes; cleared when used; not a public music feature |
orage_slack_state, orage_google_state, orage_posthog_state, orage_linear_state cookies |
Bind the matching optional provider connection to this browser | Up to 10 minutes; cleared at callback |
orage.ui in localStorage |
Sidebar and inbox-panel choices | No automatic expiry; until browser data is cleared or replaced |
orage.panels in localStorage |
Panel size, open tabs, file paths and panel browsing history | No automatic expiry; until cleared or replaced |
orage.composer in localStorage |
Model, effort, approval mode, computer, workspace and selected repository/branch preferences | No automatic expiry; until cleared or replaced |
orage.repoSets in localStorage |
Recently chosen repository groups | The app keeps up to three groups; no time-based expiry |
orage.work.view in localStorage |
Work-list display choice | No automatic expiry; until cleared or replaced |
orage.voice.mode in localStorage |
Voice interaction preference | No automatic expiry; until cleared or replaced |
orage.music.volume, orage.music.mix in localStorage |
Playback volume and local mixing override | No automatic expiry; until cleared or replaced |
orage.music.device, orage.music.player in sessionStorage |
Identify this playback tab and remember whether it was the player | Normally until the tab session ends; browsers can restore tab sessions |
orage.githubAutoAt in sessionStorage |
Prevent repeated automatic sign-in redirects | Normally until the tab session ends |
orage-lab-player-modes in localStorage, on the player lab page only |
Lab playback choices | No automatic expiry; until cleared or replaced |
Authentication cookies are HttpOnly and use SameSite restrictions. Public HTTPS requests also use Secure cookies. Sign-in state cookies are limited to their callback paths. JavaScript cannot read the HttpOnly session cookie. The browser's localStorage can contain repository names, file paths and URLs, so it is personal working data, not just harmless display settings.
The app sends allowed usage and error reports to its own /api/telemetry endpoint, which forwards them to PostHog EU. These reports use an in-memory page-session ID and can include a thread ID. The server attributes them to the owner's GitHub ID or installation ID. There is no analytics cookie, but the signed-in reports are still identifiable. Sign-out stops app reports; it does not clear every local preference or panel history automatically.
Choices and consent
You can clear cookies and site storage through browser settings. Blocking the sign-in cookie prevents normal signed-in use. Clearing preferences resets the layout and playback choices. On a shared device, clear app site storage as well as signing out. This does not delete cloud data; use the deletion process in the Privacy Policy.
Orage does not use advertising cookies, cross-app tracking, advertising identifiers or session replay. Connected provider sign-in pages, pages you open in a browser panel, and external file or model-download hosts have their own notices and may use their own cookies. Our notice does not describe every website an agent or you may visit.
Essential sign-in storage and preferences needed for a service you request do not require a cookie choice banner solely because they use browser storage. Measurement requires a separate assessment. A page-view fetch that reads page and referrer information is not automatically exempt merely because it sets no cookie. Optional storage, excessive preference retention or non-exempt measurement must receive prior consent where the law requires it.
Public-release requirement: finish that assessment, verify production hosting behavior, and either document a valid exemption, disable the affected measurement, or add the required prior-consent control with an equally easy refusal and withdrawal. The current implementation has no measurement consent control. We cannot yet state that no banner is needed for all of orage.ai and app.orage.ai. The rules cover browser storage and other access technologies as well as cookies. See the CNIL's tracking guidance and the ICO's storage and access guidance.
Last updated 2026-10-09