Cookies Policy.

This Cookies Policy applies when you visit OpenCredia websites, sign in to OpenCredia, use workspace features, claim or view credentials, verify a credential, or interact with public credential pages.

Cookies are small files stored by your browser. Similar technologies include browser storage, local storage, session storage, and other browser features that remember information or support security checks.

OpenCredia uses essential cookies to authenticate users, keep sessions active, support magic-link and multi-factor sign-in flows, bind Google / Microsoft / SSO redirects, and remember a trusted device when you choose that option. Names: `better-auth.session_token` (httpOnly, SameSite=lax, Secure on HTTPS, 7 days), `better-auth.two_factor` (httpOnly, 10 minutes during an MFA challenge), `better-auth.trust_device` (httpOnly, 30 days after you trust the device), `better-auth.dont_remember` (httpOnly session cookie when you choose not to stay signed in), and `better-auth.state` (httpOnly, 5 minutes at the start of OAuth or SSO).

Cookie-backed mutations are protected by an Origin and Referer header check (`assertCsrf`). OpenCredia does not set a CSRF cookie. A session-data cookie cache is off, so `better-auth.session_data` is not written.

These cookies are needed for sign-in and account security. If you block them, sign-in, MFA, workspace access, API administration, claim flows, or other authenticated features may not work correctly.

When Cloudflare Turnstile is enabled on sign-in, Cloudflare may set cookies or similar technologies on Cloudflare origins as part of an invisible challenge. OpenCredia does not control those cookies. Cloudflare describes that processing in Cloudflare's Turnstile Privacy Addendum. Our Privacy Policy also references that addendum.

OpenCredia also writes first-party preference and product-state storage that is not required to complete sign-in. Examples: `better-auth.last_used_login_method` (not httpOnly; allowlisted method id such as email, Google, Microsoft, magic-link, or SSO; 30 days) to highlight the last sign-in method; `sidebar_state` (7 days) for the issuer-console sidebar; `theme` as both a cookie and a localStorage key (default ThemeProvider storage key) for light, dark, or system appearance; `credia:public-discovery-search:recent-results:v2` in localStorage for recent public discovery searches; and, if a marketing announcement banner is shown and dismissed, `opencredia-banner-dismissed-v1` as a cookie and localStorage key (365 days).

Preference storage is used to improve usability. It is not intended to identify you across unrelated websites. OpenCredia does not ship a cookie-consent banner or preference center.

OpenCredia records limited analytics for public credential and verification activity so issuers can understand whether credentials are being viewed or shared.

Public verification analytics are designed to minimize raw personal data. OpenCredia avoids storing raw client IP addresses for credential view analytics and uses time-limited daily salts for deduplication where applicable.

Aggregate counts, such as views, unique views, and shares, may be shown to authorized organization or workspace users.

OpenCredia does not currently describe advertising cookies, third-party behavioral advertising cookies, or cross-site ad tracking as part of the service.

If we add analytics, advertising, or marketing tools that require additional notice or consent, we will update this policy and provide any required controls before using them in that way.

Most browsers let you delete cookies, block cookies, block third-party cookies, clear storage when you close the browser, or use private browsing modes.

Browser controls may affect OpenCredia features. Blocking essential cookies or storage may prevent sign-in, session continuity, security checks, workspace administration, credential claiming, or other parts of the service from working.

We may update this Cookies Policy as OpenCredia changes, as our use of cookies or similar technologies changes, or as legal requirements evolve.

For questions about OpenCredia's use of cookies and similar technologies, contact OpenCredia at [email protected].