Cookie Notice

1. What cookies are

Cookies are small data files stored in your browser by the websites you visit. They can hold session state, user preferences, or identifiers used by third parties.

2. Cookies Oreni sets directly

Authentication and session

• sb-* — set by Supabase Auth on login to keep you logged in across page loads. These are first-party, HttpOnly, Secure, and SameSite=Lax. Removing them logs you out.

These cookies are strictly necessary for the service to function and therefore do not require prior consent under most cookie regimes (including the EU ePrivacy Directive’s strictly-necessary exemption).

3. Third-party cookies

Support chat (Crisp)

If you open the in-app chat widget, Crisp loads its script and may set its own cookies (e.g. crisp-client/*) to maintain your conversation across visits. The widget is not loaded until you open it; if you never open it, no Crisp cookies are set.

Product analytics (PostHog)

We use PostHog to understand how visitors use Oreni — which pages get viewed, whether course generation succeeds, where people drop off — so we can improve the product. PostHog sets a first-party cookie (ph_*_posthog) to recognise repeat visits; requests are routed through our own domain rather than posthog.com directly. If you are logged in, analytics events are linked to your account; if you are not, they are linked to an anonymous identifier that resets if you clear cookies. A limited set of sessions may be recorded for product debugging — every input field (including the email field on the login page) is always masked, so nothing you type is ever captured. PostHog is hosted in the EU.

OAuth login (Google)

Choosing “Continue with Google” on the auth page redirects you to Google’s OAuth endpoint, which may set its own cookies on its domain (e.g. accounts.google.com). Those cookies are governed by Google’s policies and not by us.

4. What we do not use

• No advertising cookies. Oreni does not serve ads and does not participate in ad networks.
• No advertising or ad-network trackers (no Google Ads remarketing tag, no Facebook/Meta pixel, no TikTok pixel). Our product analytics (section 3) does not build advertising profiles and is never shared with ad networks.
• No cross-site fingerprinting.

5. Managing cookies

You can clear or block cookies from your browser settings; doing so for our domain will sign you out. You can also block Crisp by not opening the chat widget, or by blocking client.crisp.chat at the network level. PostHog requests are proxied through our own domain to avoid ad-blocker false positives, so blocklist-based extensions may not catch them; you can still clear cookies from your browser settings to reset your analytics identifier.

6. Changes to this notice

This notice reflects the cookies in use as of the date above. If we introduce a new category of tracking beyond what is described here — for example, advertising cookies — we will update this notice and, where the law requires it, ask for your consent first.

7. Contact

Questions: contact@oreni.co.