Cookie Statement — OpsTrove
Draft v1 · Effective date: October 3, 2026 · Pending qualified legal review
The short version
OpsTrove uses strictly necessary cookies only. We do not use analytics, advertising, or tracking cookies, and we do not allow third parties to track you on our Service. Because every cookie we set is required for the Service to function, no consent banner is required; this statement explains what is set and why.
Cookies we set
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| Platform session cookie (Auth.js session token) | Keeps subscribed businesses and their staff signed in securely | Session / rolling | Strictly necessary |
| Customer Portal session cookie (`opstrove_portal`) | Keeps portal customers signed in to their view-only portal | Session / rolling | Strictly necessary |
| Security/CSRF tokens | Protects sign-in and form submissions against forgery | Session | Strictly necessary |
| Cloudflare security cookies (e.g. `__cf_bm`) | Bot management and abuse protection applied by our edge provider | Up to 30 minutes | Strictly necessary |
All of our session cookies are HttpOnly (not readable by scripts), Secure (sent over HTTPS only), and scoped with SameSite=Lax.
What we do not use
- No analytics or product-telemetry cookies.
- No advertising or remarketing cookies.
- No social-media tracking pixels.
- No cross-site tracking of any kind.
Managing cookies
You can block or delete cookies in your browser settings. Blocking our strictly necessary cookies will prevent sign-in and the Service will not function.
Changes and contact
This statement is kept current with the Service. Questions: [email protected].