Cookie and Local Storage Notice
Version: cookie-local-storage-2026-09-20-v1
Effective date: 20 September 2026
Status: published
1. Scope
This notice explains information stored on or read from a visitor's or user's device by the Orsta marketing website and application. Browser local storage and session storage are storage technologies, but they are not cookies.
Orsta does not currently use analytics, advertising, cross-site tracking, session replay or other non-essential storage technologies. The marketing website does not deliberately set cookies or use local or session storage.
2. Application storage
| Technology | Information | Purpose | Duration/control |
|---|---|---|---|
| Supabase authentication local storage | Authentication session, including access and refresh tokens and associated session/user data, under a provider-generated key | Keep the user signed in, refresh the session and authenticate requests | Persistent until sign-out, expiry/revocation, application removal or the user clears site data; individual tokens have provider-managed lifetimes |
activeCompanyId local storage |
Selected company identifier | Keep the user's active company selected and scope application requests | Persistent until changed, the company becomes unavailable, sign-out handling removes it, or site data is cleared |
| Component preview-orientation local storage | Portrait or landscape selection for the component being edited | Remember an appearance/working selection | Persistent until changed or site data is cleared |
orsta-theme-session session storage |
Light or dark theme selection for the current tab | Apply the user's current-tab appearance choice | Ends when the browser tab/session ends or the user clears site data |
orsta_idle_logout_recovery session storage |
Whether draft changes were saved before an automatic inactivity sign-out | Tell the user whether recent draft changes were saved | Removed when the application next reads it; otherwise it ends when the browser tab/session ends or site data is cleared |
orsta-preload-recovery-at session storage |
Time of the most recent automatic recovery attempt | Prevent repeated reload loops after a failed application update/preload | Ends when the browser tab/session ends or site data is cleared |
Cloudflare cf_clearance cookie, only if a security challenge is presented |
Proof that the browser passed a Cloudflare security challenge | Protect the proxied website, application or API from suspicious automated traffic | Current Cloudflare challenge passage is 30 minutes; the cookie is not set during an ordinary visit without a challenge |
3. Why there is no consent banner
The current technologies support authentication, security, technical-fault recovery, and selections needed for the service the user requests. Orsta therefore treats them as falling within applicable PECR exceptions. They are still described transparently here.
Before enabling any non-exempt analytics, advertising, profiling or similar technology, Orsta will update this notice, prevent that technology from running before any required consent, and provide an appropriate consent control.
4. Browser and provider controls
Users can sign out or clear Orsta site data through browser settings. Clearing authentication storage signs the user out and clearing preferences resets them. Blocking necessary storage may prevent the application from working.
Cloudflare may set the security cookie listed above when a browser passes a security challenge.
5. Changes and contact
Orsta will audit storage technologies when providers or frontend dependencies change and before introducing non-essential purposes.
Questions may be sent to privacy@orsta.app or Orsta Ltd, Suite RA01, 195-197
Wood Street, London, United Kingdom, E17 3NU. Orsta Ltd is registered in
England and Wales with company number 17403586.