Cookie Policy

What this policy covers

This Cookie Policy describes the technologies that OTNEL ("we," "us," or "our") uses when you visit https://arcana.otnelhq.com, use the Arcana web console, or interact with any hosted part of the Services. It explains what these technologies are, why we use them, and how you can control them. This policy should be read alongside our Privacy Policy and Terms of Service.

Scope of technologies. This policy covers not only traditional HTTP cookies, but also localStorage, sessionStorage, IndexedDB, web beacons, pixels, and any other technology that stores or accesses information on your device when you use the Services.

Relationship to Privacy Policy. The Privacy Policy explains how we process Personal Data, while this Cookie Policy focuses specifically on the cookies and similar technologies used on the website and console. Where a topic is addressed in both policies, the two should be read together.

Who is covered. This policy applies to all visitors to the Arcana website and all users of the hosted web console, regardless of whether they have created an account. If you use only the open-source Arcana CLI and never visit our website or console, this policy does not apply to that local use.

Purpose of transparency. We publish this policy to help you understand what technologies are active, why they are necessary or useful, and how you can manage your choices. We believe that transparency builds trust and empowers users to make informed decisions.

No advertising tracking. We do not use cookies or similar technologies to track you across third-party websites for advertising purposes. Our use of these technologies is limited to operating and securing the Services, remembering your preferences, and understanding website performance.

Updates. As we update the website and console, we may introduce new technologies or retire old ones. When we make material changes, we will update this policy and the effective date at the top of the page.

Questions. If you have questions about this policy or our use of cookies and similar technologies, please contact us at [email protected].

What are cookies and similar technologies?

Cookies are small data files that a website sends to your browser and that are stored on your device. They are widely used to make websites work more efficiently, as well as to provide reporting information and deliver personalized experiences. Cookies typically contain a string of characters that uniquely identifies your browser or device.

How cookies work. When you visit a website, your browser sends cookies back to the website's server with each subsequent request. This allows the website to recognize your browser, maintain your session, remember your preferences, and gather analytics about how you use the site.

First-party and third-party cookies. First-party cookies are set by the website you are visiting. Third-party cookies are set by domains other than the one you are visiting, often for advertising or analytics. We use first-party cookies for core functionality and third-party cookies only for security purposes through Cloudflare.

Session and persistent cookies. Session cookies are deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them. We use both types, depending on the purpose.

Similar technologies. In addition to cookies, we use similar technologies such as localStorage, sessionStorage, and IndexedDB. These are browser storage mechanisms that allow us to store data on your device. Unlike cookies, they are not automatically transmitted to our servers on every request; they are read and written by client-side JavaScript when needed.

localStorage. localStorage allows websites to store data on your device with no expiration date. We use localStorage to remember your theme preference, consent choices, and console settings across visits and sessions.

sessionStorage. sessionStorage is similar to localStorage, but data is cleared when you close the browser tab or window. We use sessionStorage for temporary state that does not need to persist beyond a single browsing session.

IndexedDB. IndexedDB is a more powerful browser database that can store larger amounts of structured data. We may use IndexedDB for caching console data or other complex state locally on your device.

Web beacons and pixels. We may use web beacons or tracking pixels in marketing emails or status notifications to understand engagement. We do not deploy them for cross-site tracking on the Arcana website.

Types of technologies we use

We classify the technologies used on our website and console into the following categories:

• Essential. Strictly necessary for the website or console to function. They enable core features such as authentication, security, and session management. Without these technologies, the Services cannot operate.
• Functional. Enhance your experience by remembering your preferences and settings, such as your theme choice, UI state, and selected options in the console. They do not track you across sites.
• Analytics. Help us understand how visitors use our website, measure performance, and improve the Services. Analytics data is generally aggregated and does not identify you personally.

Essential by necessity. Essential technologies are those without which the website or console could not provide the service you requested. Examples include authentication cookies, security tokens, and consent records. Because they are necessary, they are deployed without consent where required by law.

Functional by choice. Functional technologies remember choices you make and improve your experience. They are not strictly necessary, but disabling them may reset your preferences and reduce convenience.

Analytics by consent. Analytics technologies collect information about website usage in an aggregated or pseudonymized form. Where required by law, we obtain your consent before deploying analytics technologies.

No advertising category. We do not use advertising cookies, behavioral targeting cookies, or social media tracking cookies on the Arcana website or console. We do not build advertising profiles or sell cookie data to advertisers.

Overlap. Some technologies may serve multiple purposes. For example, a security cookie may also provide functional benefits. In our inventory, we classify each technology by its primary purpose.

Changing categories. If the purpose of a technology changes, we will update its classification in this policy and, where required, obtain renewed consent.

Technology inventory

The table below lists the main cookies, localStorage items, and similar technologies we use, their purpose, duration, and category. This list is representative and may be updated as we improve the Services.

Name	Type	Purpose	Duration	Category
arcana_session / related auth cookies	HTTP cookie	Maintain your authenticated session across requests; protect against CSRF.	Session or up to 7 days with "remember me"	Essential
arcana-cookie-consent	localStorage	Record whether and how you have accepted this Cookie Policy.	Until cleared by user	Essential
arcana-site-theme	localStorage	Remember your light or dark theme preference across pages.	Until cleared by user	Functional
arcana_console_* / arcana_status_v2 / arcana_viz_* / arcana_memory_* / arcana_proxy_* / arcana_billing_* / arcana_settings_*	localStorage / sessionStorage	Persist UI state, status history, memory visualization settings, proxy preferences, billing view state, and console settings across sessions or page reloads.	Varies; localStorage until cleared, sessionStorage until tab closes	Functional
Cloudflare __cf_bm / _cfuvid	HTTP cookie	Identify and mitigate automated traffic and abuse; maintain rate-limiting state.	Up to 30 minutes for __cf_bm; session for _cfuvid	Essential
Cloudflare analytics / beacon (Cloudflare Web Analytics)	Script / cookieless beacon	Measure site performance, traffic patterns, and error rates without individual user tracking.	Per-session / ephemeral	Analytics

Inventory purpose. The inventory above is provided to give you a clear understanding of the technologies currently in use. It is not exhaustive, and minor or transient technologies may not be listed.

Prefix convention. Many of our localStorage keys use the arcana_ prefix to make them easy to identify. Keys with additional suffixes may be created by specific console features, such as memory visualization or status history.

Updates to inventory. When we add or remove technologies, we will update this table and the effective date of the policy. Material changes to the inventory may be accompanied by a notice in the console or on the website.

Wildcards. Some entries in the table use wildcard patterns because a feature may create multiple related keys. For example, memory visualization may store separate keys for layout, color scheme, and filter settings.

No hidden trackers. We do not use fingerprinting, hidden pixels, or other covert tracking mechanisms that are not disclosed in this policy or the Privacy Policy.

Essential cookies and storage

Essential cookies and storage items are necessary for the Services to function and to provide you with secure access. They are set in response to your actions, such as logging in, accepting this policy, or using security features. Because these technologies are essential, they cannot be disabled through our cookie banner without degrading or preventing access to the Services.

Specifically, essential technologies are used to:

• authenticate you and keep you signed in;
• protect the Services against malicious traffic, abuse, and automated attacks;
• maintain session integrity and CSRF protection;
• record your cookie consent decision; and
• ensure correct routing and load balancing through our hosting infrastructure.

Authentication. When you sign in to the Arcana console, we set an authentication cookie or token that identifies your session. This allows you to navigate the console and access your account without signing in on every page.

CSRF protection. We use tokens stored in cookies or localStorage to protect against cross-site request forgery attacks. These tokens ensure that actions performed in the console are initiated by you and not by a malicious third-party website.

Bot management. Cloudflare sets essential cookies to distinguish between legitimate users and automated traffic. These cookies help prevent denial-of-service attacks, scraping, and credential stuffing.

Consent record. We store your cookie consent decision in localStorage so that we do not repeatedly ask you to accept this policy. This record is itself an essential technology because it enables us to comply with legal consent requirements.

Load balancing. Our hosting infrastructure may use cookies or routing identifiers to direct your requests to the appropriate server and to maintain session affinity. This improves performance and reliability.

Cannot be disabled. Because essential technologies are required for the Services to function, you cannot opt out of them through our cookie banner. You may be able to block them through your browser settings, but doing so will prevent the Services from working correctly.

Legal basis. Under data protection law, essential cookies and storage are typically justified as necessary for the performance of a contract or for our legitimate interest in providing a secure service.

Functional storage and preferences

Functional technologies enable the Services to remember choices you make and provide enhanced features. These are used only to improve your experience within the same browser and do not track you across third-party websites.

Examples include:

• Remembering whether you selected the light or dark theme;
• Preserving the collapsed or expanded state of console panels;
• Storing your preferences for memory visualization, status display, proxy routing, and billing views;
• Caching recent data locally so the console loads quickly; and
• Storing ephemeral session data required for a single browser tab.

Theme preference. We store your choice of light or dark theme in localStorage so that the website and console appear consistently each time you visit. This preference is tied to your browser, not your account.

Console state. The Arcana console may remember the layout of panels, the visibility of sidebars, and the selected tabs. This improves usability by restoring your workspace on subsequent visits.

Feature preferences. Preferences for memory visualization, status history display, proxy routing, and billing views are stored locally to preserve your customized experience. These preferences do not affect the underlying data or service functionality.

Local caching. We may cache recent console data in localStorage or IndexedDB so that the console loads quickly and remains usable during brief connectivity interruptions. Cached data is refreshed from the server when a connection is available.

No cross-site tracking. Functional storage is scoped to the Arcana website and is not used to track you across other websites. We do not share functional storage data with third parties for advertising or profiling.

Clearing functional storage. You can clear functional storage at any time through your browser settings. Doing so will reset your preferences and may require you to reconfigure settings, but it will not prevent you from using the core Services.

Consent. Where required by law, we obtain your consent before setting non-essential functional storage. You can withdraw consent by clearing site data or changing your browser settings.

Analytics and telemetry

We use Cloudflare Web Analytics to collect information about how visitors use the Arcana website. This service is privacy-preserving by design: it does not use third-party cookies for tracking and does not collect personally identifiable information such as your name, email address, or precise browsing history across sites. It helps us understand page views, load times, error rates, and traffic sources.

What analytics measures. Analytics data helps us understand how visitors interact with the website, which pages are most popular, how long pages take to load, and where errors occur. This information guides our development and optimization efforts.

Privacy-preserving design. Cloudflare Web Analytics is designed to collect aggregated, cookieless data. It does not track individual users across sessions or websites, and it does not collect precise personal identifiers.

No user-level profiles. We do not combine analytics data with your Account information to create user-level profiles. Analytics reports show aggregated trends, not the behavior of named individuals.

Telemetry. In addition to website analytics, we may collect telemetry from the Services, such as error rates, API latency, and feature usage statistics. This telemetry is used to maintain reliability and improve performance.

Use of data. Analytics data is used solely for the purposes of improving the Services, diagnosing issues, and understanding product usage. We do not use analytics data for marketing, profiling, or sale to third parties.

Retention. Analytics data is retained in accordance with Cloudflare's policies and our own data retention practices. Aggregated reports may be retained indefinitely, while raw analytics data is typically retained for a shorter period.

Opt-out. Because Cloudflare Web Analytics is cookieless and privacy-preserving, there is no individual user identifier to opt out of. However, you can manage analytics participation through the cookie banner where required by law, or by using browser settings and tracker blockers.

Third-party analytics. We do not use Google Analytics, Meta Pixel, or other mainstream analytics services that rely on advertising-style tracking. Our analytics choices reflect our commitment to minimizing data collection.

Third-party cookies and services

We do not place advertising or marketing cookies from third parties. The only third-party technology that sets cookies or processes requests is Cloudflare, which provides our hosting, security, and analytics services. Cloudflare may set essential cookies for bot management and security. Cloudflare's use of data is governed by its own Privacy Policy and Cookie Policy.

Cloudflare's role. Cloudflare provides content delivery, DDoS protection, bot management, and privacy-preserving analytics for the Arcana website. Cloudflare may process request metadata and set essential cookies as part of these services.

No advertising networks. We do not permit advertising networks, social media platforms, or data brokers to set cookies or collect data through our website. We do not participate in behavioral advertising ecosystems.

LLM Providers. When you configure the Arcana CLI or web console to communicate with an LLM Provider (such as OpenAI, Anthropic, or Google), your requests are sent directly to that provider under its own terms and cookie policies. OTNEL does not control those providers' cookies or tracking practices.

Payment processors. PayPal may set cookies or process data when you make a payment through its checkout flow. PayPal's cookie and privacy practices are governed by its own policies.

Authentication provider. Supabase, our authentication provider, may set cookies or tokens as part of the sign-in process. These are essential for account security and are governed by Supabase's terms.

Links to third parties. Our website may contain links to third-party websites, such as documentation or LLM Provider sites. We are not responsible for the cookie or privacy practices of those websites.

Changes in subprocessors. If we add a new subprocessor that sets cookies or uses similar technologies in a materially different way, we will update this policy and, where required, obtain consent before deploying the technology.

How to manage your choices

You have several options for controlling cookies and similar technologies:

• Cookie banner. When you first visit our website, we show a cookie banner that allows you to accept or decline non-essential analytics technologies. You can revisit this choice through your browser settings by clearing stored data.
• Browser settings. Most web browsers allow you to manage cookies through their settings. You can set your browser to refuse all cookies, delete existing cookies, or alert you when a cookie is being sent. Please consult your browser's help documentation for instructions.
• localStorage and sessionStorage. These can be cleared through your browser's "Clear browsing data" or "Clear site data" functions. Clearing site data will remove stored preferences and may sign you out of the console.
• Do Not Track. Some browsers send a "Do Not Track" signal. We do not respond to such signals because no uniform industry standard exists, but our analytics and tracking practices are limited to the categories described in this policy.

Cookie banner details. Our cookie banner explains the categories of technologies we use and invites you to manage your preferences. Essential technologies cannot be disabled through the banner, but you can choose whether to accept analytics technologies where consent is required.

Browser controls. Modern browsers allow you to block all cookies, block third-party cookies, delete cookies on exit, or create exceptions for specific websites. You can also use private or incognito browsing modes to prevent persistent storage.

Clearing site data. Clearing site data for arcana.otnelhq.com will remove all cookies, localStorage, sessionStorage, and other stored information for our domain. This will sign you out of the console and reset your preferences.

Third-party tools. You may use browser extensions, tracker blockers, or privacy-enhancing tools to manage cookies and storage. We do not guarantee compatibility with every tool, and some tools may interfere with the functionality of the Services.

Do Not Track signals. Because our analytics are already privacy-preserving and we do not engage in cross-site behavioral tracking, Do Not Track signals do not materially change our practices. However, we respect the intent of such signals and limit tracking accordingly.

Mobile browsers. Cookie and storage management options may differ on mobile browsers. Please consult the help documentation for your mobile browser or operating system.

Cookie banner and consent record

When you visit the Arcana website, we display a cookie notice that explains our use of cookies and invites you to accept our Cookie Policy. Your consent decision is stored in localStorage under arcana-cookie-consent. This record is maintained so that we do not repeatedly show the banner on subsequent visits.

Consent mechanism. The banner provides clear information about the categories of technologies we use and, where required by law, allows you to accept or decline non-essential technologies. Your choice is recorded and respected on future visits from the same browser.

Granular consent. For users in jurisdictions that require granular consent, such as the European Economic Area, the banner will allow you to accept or decline analytics technologies separately from essential technologies. Essential technologies cannot be disabled because they are necessary for the Services.

Record of consent. We store a record of your consent choice, including the version of the policy you accepted and the date of acceptance. This record helps us demonstrate compliance with consent requirements.

Withdrawing consent. You can withdraw consent for non-essential technologies at any time by clearing site data for arcana.otnelhq.com or by using the browser controls described in the How to manage your choices section. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

Re-displaying the banner. We may re-display the cookie banner if we make material changes to this policy, if you clear your browser storage, or if you use a different browser or device.

No deceptive design. We design the cookie banner to be clear and easy to use. We do not use manipulative interfaces, dark patterns, or pre-ticked boxes to obtain consent.

No account requirement. Cookie consent is managed at the browser level and does not require an Arcana account. If you sign in, your cookie consent record remains separate from your account data.

Versioning. If we update this policy in a way that affects the categories of technologies covered by consent, we will update the banner and request renewed consent where required by law.

Changes to this policy

We may update this Cookie Policy from time to time to reflect changes in technology, regulation, or our practices. If a change is material, we will provide notice through the website or console and update the effective date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Services after the effective date of any revised Cookie Policy constitutes your acceptance of the changes.

Material changes. A material change is one that introduces a new category of technology, adds a new third-party cookie provider, changes the purpose of an existing technology in a significant way, or affects your consent rights.

Notice methods. We may notify you of material changes by displaying a banner on the website, posting a notice in the console, updating the effective date, or sending an email if you have an account.

Advance notice. Where practicable and required by law, we will provide advance notice of material changes before they take effect. If you do not agree to a material change, you can stop using the Services or clear your cookies and storage.

Non-material changes. Minor changes, such as clarifications, formatting updates, or the correction of typographical errors, may be made without advance notice. Such changes will be posted on this page with an updated effective date.

Consent renewal. If a material change affects technologies for which we obtained your consent, we will renew your consent through the cookie banner or another appropriate mechanism before deploying the change.

Historical versions. We do not currently maintain a public archive of prior versions of this policy. If you need a prior version, please contact us and we will provide it if reasonably available.

Your responsibility. It is your responsibility to review this policy periodically and to ensure that your browser settings reflect your preferences. We are not liable if you miss a change because you did not review the policy.

Contact

If you have any questions about this Cookie Policy or our use of cookies and similar technologies, please contact us.

Inquiries. We welcome questions and feedback about this policy. We will use your questions to improve our documentation and, where appropriate, clarify our practices.

Privacy requests. If your question relates to the broader processing of your Personal Data, please refer to our Privacy Policy, which describes how to exercise your data protection rights.

Response time. We aim to respond to cookie-related inquiries within a reasonable time. If your inquiry is part of a formal data protection request, we will respond in accordance with the timeframes set out in the Privacy Policy.

No legal advice. Our responses to inquiries are for informational purposes only and do not constitute legal advice. If you need legal advice, please consult a qualified attorney.