1. Overview
Oruvai uses cookies, local storage and comparable device technologies only for a documented purpose. Strictly necessary storage supports security, login, language and the service you explicitly request. The Google tag loads on public pages with analytics storage denied. Before consent, Google Analytics cookies remain blocked and only cookieless page-measurement and consent signals may be sent. Advertising storage, Google Signals and advertising personalisation remain disabled.
Rejecting analytics does not reduce the core service. The Google tag remains in denied mode, sets no Google Analytics cookies and receives no account ID, email address or form content from Oruvai.
2. Strictly necessary storage
Authentication and session
The production cookies __Host-oruvai_session and __Host-oruvai_csrf maintain login and protect state-changing requests. Both are Secure, HttpOnly and SameSite=Lax, apply to path / and have a maximum lifetime of 30 days. Browser JavaScript cannot read them.
Security and delivery
Cloudflare may set necessary identifiers such as cf_clearance or _cfuvid when a security check is actually triggered. Name and lifetime depend on the protection feature; they are not used for Oruvai advertising.
Display preferences
oruvai-reduced-motion and oruvai-media-previews store the movement and media-preview choices selected by the user in local storage. They are not used for cross-site tracking.
3. Local application data
The native app stores product state, manually edited library and list data, pending sync operations, cached runtime configuration and a random client-instance identifier in Async Storage or SQLite. Account and group access tokens are stored in the protected Secure Store on iOS and Android.
Local product data remains until the relevant reset or deletion control, account deletion or removal of the app. Signing out ends the server session; non-account display or offline preferences may remain on the device.
- No full card or bank credentials in Oruvai local storage
- Analytics queue only when product analytics and consent are active; disabling analytics deletes it
- Pending offline changes are removed from the queue after successful synchronisation
4. Optional technologies
Google Analytics 4 uses Google Consent Mode on public pages. Until analytics consent is granted, analytics storage stays denied and the tag may send cookieless page-measurement and consent signals. After consent, Google Analytics cookies support aggregate usage analysis. The implementation does not send account IDs, email addresses or form contents as analytics parameters. Query strings are excluded, and private route identifiers are replaced with generic route patterns before page paths are sent.
- Analytics: Google Analytics 4, measurement ID G-8JN6BV58RJ; cookies and full browser recognition require consent
- Advertising storage and personalisation: disabled
- Google Signals: disabled
- Affiliate attribution: only when a labelled commercial link requires it
- Session replay: not active
5. Your choices
When optional technologies exist, the footer will provide a persistent Privacy choices link. You can accept or reject categories with equal ease and withdraw consent for the future. Browser controls can also delete stored data, but blocking strictly necessary storage may prevent login or requested features from working.
6. Production storage register
__Host-oruvai_session
Provider: Oruvai. Purpose: authenticated web session. Category: strictly necessary. Lifetime: no more than 30 days, and earlier on logout. Type: Secure, HttpOnly, SameSite=Lax cookie.
__Host-oruvai_csrf
Provider: Oruvai. Purpose: protects against cross-site state-changing requests. Category: strictly necessary. Lifetime: no more than 30 days, and earlier on logout. Type: Secure, HttpOnly, SameSite=Lax cookie.
oruvai.analytics-consent.v1
Provider: Oruvai. Purpose: remembers whether analytics was accepted or rejected. Category: necessary consent record. Lifetime: until the choice changes or device storage is cleared. Type: local storage or Async Storage.
oruvai-reduced-motion / oruvai-media-previews
Provider: Oruvai. Purpose: user-selected presentation. Category: explicitly requested function. Lifetime: until changed or browser storage is cleared. Type: local storage.
_ga
Provider: Google Analytics 4. Purpose: distinguishes browsers for aggregate usage analytics. Category: optional analytics. Default lifetime: two years. Created only after acceptance.
_ga_<container-id>
Provider: Google Analytics 4. Purpose: persists analytics session state. Category: optional analytics. Default lifetime: two years. Created only after acceptance.
Cloudflare security identifiers
Provider: Cloudflare. Possible names include cf_clearance, _cfuvid, __cfruid or technical challenge identifiers. Purpose: security challenge, rate limiting or abuse prevention. Category: only where the relevant protection function is strictly necessary. Lifetime: feature-dependent.
Choosing Reject analytics sends a denied consent update, removes accessible Google Analytics cookies and clears the local analytics queue. Browser or system controls can clear remaining local data.
7. Questions
Questions about device storage or consent can be sent to [email protected].
Questions about this document? [email protected]