Cookie Policy
Last updated: 19 July 2026
Current cookie use
Cookies are small files stored on a device. The UK Privacy and Electronic Communications Regulations (PECR) generally require consent before a site stores information on, or accesses information from, a device. An exception applies where this is strictly necessary to provide a service the user has requested.
oembrain currently uses only first-party cookies needed for account security, sign-in and an explicitly requested language choice. It does not use advertising, behavioural tracking or analytics cookies. Cloudflare Web Analytics is cookieless and does not store or access information on the device. No consent banner is required while the application uses only cookies covered by the PECR strictly necessary exception and analytics that does not store or access device information. We will introduce an appropriate consent choice before setting any non-essential cookies or using other non-essential device storage or access.
| Cookie | Classification and purpose | Duration |
|---|---|---|
PHP session cookie (the server-configured PHP session name, commonly PHPSESSID) | Strictly necessary. Maintains session security, sign-in state, CSRF protection, language choice and short-lived interface messages. The service's protected forms and account area cannot work correctly without it. | Browser session. |
remember_token | Strictly necessary when requested. A credential used to restore a sign-in only when the user chooses “remember me”. It is HttpOnly, Secure in production and SameSite=Lax. | Up to 30 days, or until logout or revocation. |
remember_user_id | Strictly necessary when requested. Identifies the account associated with the remember-me credential. It cannot authenticate a user by itself and has the same cookie protections. | Up to 30 days, or until logout or revocation. |
oembrain_locale | Language preference; exempt when requested. Set only after a user actively selects a supported language, so the service can provide that requested language on later visits. We treat this as within the PECR strictly necessary exception for the user's requested language setting. | Up to 1 year. |
Third-party resources
Public and application pages load a Cloudflare Web Analytics beacon. It collects page-view and browser performance metrics without cookies or other client-side storage and is designed not to track individuals across Cloudflare customers' websites. Bootstrap and Bootstrap Icons are served from oembrain's own assets.
When a user deliberately follows a Stripe checkout or billing link, or connects Xero, those providers may set cookies on their own domains under their own notices. Those third-party-domain cookies are controlled by the relevant provider, not by oembrain.
Managing cookies
Browser controls can block or delete cookies. Blocking the session cookie prevents sign-in and protected forms from working. Users can avoid the 30-day cookies by leaving “remember me” unticked and can clear them by logging out. Deleting oembrain_locale returns the site to its default or account language until another language is selected.
Changes and contact
This page will be updated before optional cookie-based tools are introduced. Questions can be sent to [email protected] or by post to OEM DRIVE LTD, 10 Duncombe Street, Bletchley, Milton Keynes, MK2 2LY.