OVARIANA Cookies and Browser Storage

Version: OVA-LEGAL-APP-STORAGE-EN-2026-10-25-r3

Effective date: 2026-10-25

OVARIANA uses mechanisms needed for sign-in, security, selected functions and user-chosen preferences. The current App code does not introduce third-party advertising or analytics cookies.

Cookies and session

Supabase Auth uses session cookies handled by the SSR library; names may use an sb- prefix. They are needed for secure sign-in, session maintenance and refresh.

A cookie matching ovariana-onboarding-t1-v2-<account hash> records completion of the short onboarding flow. Current code sets a maximum age of 365 days, HttpOnly, SameSite=Lax, path / and Secure in production. It does not contain journal health content.

Hosting or traffic-protection infrastructure may set strictly technical mechanisms needed for security or delivery.

localStorage

• ovariana-language — saved browser UI-language preference; it is neither express confirmation nor the authoritative source of the primary account language;

• ovariana-display-theme — light/dark display;

• ovariana-high-contrast — contrast preference;

• ovariana-interface-font — interface font;

• ovariana-interface-style — OVARIANA/MEDMINIMAL style.

Preferences remain until changed or site data is cleared.

sessionStorage

The ovariana-entry-destination key stores an allowed relative destination during entry or sign-in. It is read and removed when consumed. It grants no account or health-function access.

The App may use keys beginning with ovariana-today: and ovariana-normal: for transient current-session action state. Such state may indirectly reveal health-related activity and is covered by privacy controls and controlled-state erasure. sessionStorage is limited to the relevant browser/tab session.

Consent and necessity

Article 399 of the Polish Electronic Communications Law applies to storing or accessing information in terminal equipment, including mechanisms other than classic cookies. Mechanisms strictly necessary for sign-in or a function requested by the user may operate within the applicable exemption. Optional mechanisms requiring consent must not be written before consent.

Control

Cookies and site data can be controlled in browser settings. Blocking authentication mechanisms may prevent sign-in. Removing localStorage preferences restores defaults.

Provider payment pages

Storage on Stripe Checkout/Link domains is covered by the relevant provider notices. Embedded integrations that store data or make calls on the OVARIANA domain must be included in that domain’s actual capture. Absence of advertising cookies in App code is not a claim about all mechanisms on external payment pages.