Kortyx Cookies and Similar Storage Notice

Kortyx uses browser storage for requested website features, sign-in and Cloud operation. This notice explains the mechanisms and their purposes. Broader data uses, recipients and request rights are in the Website Privacy and Software Telemetry Notice and Cloud Privacy Notice. Contact legal@kortyx.io about storage or privacy choices.

A cookie can be sent automatically with relevant browser requests. Local storage remains in the browser until cleared; session storage normally ends with the relevant tab/session. A random identifier can still relate to identifiable activity. Browser expiry is distinct from retention of server records or information already received by a provider.

The public website’s current configuration has necessary storage only; it does not load an optional analytics or session-replay script as part of this release. The “Privacy settings” control in the footer explains the current choice and storage. Acknowledging a necessary-storage notice is not permission for future optional analytics.

Name or mechanism	Purpose and provider	Persistence and scope
kortyx_privacy preference storage	Kortyx’s self-hosted/offline c15t interface remembers privacy choices; no Cloud Terms acceptance is recorded by it	Configured preference-cookie duration 180 days; related local storage remains until cleared. Site-specific, without cross-subdomain sharing
theme local storage	Remembers a requested light/dark appearance	Until the visitor changes it or clears site storage
Documentation navigation session storage	Remembers sidebar position and expanded/collapsed sections for the current documentation context	Browser session/tab; not a marketing identifier

A necessary or user-requested function must not repurpose its storage for unrelated profiling. The use of a first-party name or open-source library does not by itself make an analytics purpose necessary.

Mechanism	Purpose	Duration or governing session
__Host-kortyx_session	Opaque reference to the requested authenticated Cloud session	Browser-session cookie; the server can expire or revoke the session independently
__Host-kortyx_login	Binds a sign-in transaction and protects its return flow	Short-lived transaction, normally five minutes; cleared when completed or restarted
__Host-kortyx_logout	Binds the sign-out return flow	Up to five minutes, then cleared or expired
__Host-kortyx_workspace, __Host-kortyx_project	Remembers the user’s selected workspace/project context	Up to 30 days; access is still checked server-side
kortyx.cloud.analytics.v1 local storage	Stores this browser’s separate allow/reject choice for optional Cloud product analytics; no account or Terms acceptance identity	Valid for 180 days; missing/invalid/expired choices default to off and are requested again
Keycloak authentication cookies	Maintain the identity-provider authentication transaction, authenticated SSO session and requested “Remember me” behavior	Transaction/session dependent. Current realm session policy has 30-minute idle and ten-hour maximum standard sessions; “Remember me” uses seven-day idle and 30-day maximum sessions. Cookie expiry and a server session’s validity are separate

Cloud application cookies are scoped to the application host; identity-provider cookies are scoped to its authentication host. Production and staging use different hosts and stores. Authentication cookies use the protections appropriate to their purpose; the __Host- cookies are host-bound, secure and HTTP-only. Internal Admin has its own authenticated session and staff authorization and is not granted by customer cookies.

The identity-provider cookie names and compatibility variants can depend on the active sign-in flow and browser. They include authentication-session, restart and SSO/remember-me mechanisms. They do not grant permission to use customer content for analytics. A successful identity-provider session does not replace required application authorization or the current contractual acceptance check.

After the separate browser choice allows it, Cloud usage instrumentation can use kortyx.usage.id in local storage to hold a random pseudonymous browser identifier; it persists until cleared, with an in-memory fallback where storage is unavailable. Rejecting or withdrawing disables browser capture, discards queued unsent aggregates and removes the stored Cloud usage identifier. The choice is available in Account settings. Self-hosted Studio has its own operator controls and is not silently changed by a Cloud preference. The provider destination is PostHog Cloud EU. Measurements use fixed operation/feature categories and bounded aggregates rather than customer prompts, outputs or trace bodies. Session replay and automatic page-content capture are outside this release.

This is product analytics, separate from storage necessary for sign-in. Where consent is required, optional browser collection must remain off until the relevant choice and stop after withdrawal. An operator-wide environment opt-out is not a substitute for a browser user’s required choice. Before enabling optional browser collection that requires consent, Kortyx will provide an effective Cloud-specific choice and withdrawal control. The current necessary-only website dialog does not control Cloud analytics.

SDK/CLI telemetry does not necessarily use a browser. Its installation identifier and KORTYX_USAGE_TELEMETRY_DISABLED control are described in Website Privacy section 5. Changing a website cookie preference does not change software running on an independent computer or server.

Optional tracking must have a clear purpose and an effective choice before collection where required. Rejecting analytics cannot prevent ordinary public-site access or the essential authenticated service. We will identify a control’s actual scope; clearing browser storage, using another device or starting a private session may require a new choice. No cross-device synchronization is promised.

Browser settings can inspect, delete or restrict cookies and local storage. Blocking a necessary authentication mechanism may prevent sign-in. Deleting a cookie alone does not close an account, revoke every device session or erase server-side contractual evidence. Use the relevant account/session controls or the private request channel for those actions.

If a browser or applicable law provides an additional privacy signal or opt-out right, we will assess and honor the obligation applicable to that processing. We do not represent a technical integration for an unimplemented browser signal merely by stating that rights are preserved.

Cloud Terms acceptance records the affirmative agreement to a specific document version and hash on the server. Website privacy preferences concern browser mechanisms. Optional onboarding answers concern understanding customer needs. Promotional subscriptions have separate permission and withdrawal. None of these can silently substitute for another.

The expiry of a preference or session cookie does not establish physical deletion of all associated information. The privacy notices describe analytics, security, correspondence, acceptance and backup retention and the applicable request rights. A provider may receive network metadata during a request even where the request contains no browser cookies.

Before enabling a new optional service, replay feature, tracking pixel or materially different purpose, Kortyx will update the relevant disclosure and obtain any required choice. Planned Google Analytics, search-management or website analytics integrations are not listed as active merely because they have been discussed. A revised notice alone is not renewed consent.

Published versions remain identifiable through permanent links. For questions or a request, email legal@kortyx.io without including passwords, session-cookie values, authentication codes or unnecessary identity documents.