Cookie Policy
Last updated: 18 July 2026
Current cookie use
oembrain currently uses only cookies needed to provide sign-in, account security and language selection. It does not currently include advertising cookies, behavioural tracking, or analytics cookies. Because no optional cookies are currently set by this application, the site does not display a consent banner. A consent choice will be introduced before any optional cookie-based analytics or advertising is enabled.
| Cookie | Purpose | Duration |
|---|---|---|
PHP session cookie (the server-configured PHP session name, commonly PHPSESSID) | Maintains a signed-in session, CSRF token, language choice and short-lived interface messages. Essential. | Browser session. |
remember_token | Optional “remember me” credential used to restore a sign-in. Essential only when the user asks to be remembered; HttpOnly, Secure in production and SameSite=Lax. | Up to 30 days, or until logout/revocation. |
remember_user_id | Identifies the account associated with the optional remember-me token. It is not sufficient to authenticate by itself. Same protections and purpose as above. | Up to 30 days, or until logout/revocation. |
Third-party resources
Public and application pages currently request Bootstrap CSS, Bootstrap Icons and Bootstrap JavaScript from jsDelivr. The application does not ask jsDelivr to set an oembrain cookie, but the request exposes ordinary connection information such as IP address, browser details and the requested page's referrer subject to browser policy. [Confirm whether production will continue using jsDelivr or self-host these assets, and verify jsDelivr's current processing terms before publication.]
Stripe or Xero pages and redirects may operate under those providers' own cookie notices when a user deliberately uses those services. Cookies on their domains are not controlled by oembrain.
Managing cookies
Browser controls can block or delete cookies. Blocking the session cookie prevents sign-in and other protected forms from working. Users can avoid the 30-day cookies by leaving “remember me” unticked and can clear them by logging out.
Changes and contact
This page will be updated before optional cookie-based tools are introduced. Questions can be sent to [email protected]. [Confirm the production privacy contact and company address.]