Oktra Cookie Policy
Last updated 2026-07-06
Version: 1.0 (2026-07-06) Published at: https://oktra.ai/legal/cookies Applies to: app.oktra.ai and all Oktra application surfaces Contact: privacy@oktra.ai
1. What cookies are
Cookies are small text files a website stores on your device. Similar technologies (localStorage, session storage, pixels) are covered by this policy under the same rules.
2. Our approach: essentials only, everything else is opt-in
Oktra uses only strictly necessary cookies - the ones required to sign you in securely and protect your session. We currently use no analytics cookies, no advertising or marketing cookies, and no third-party tracking of any kind.
If we ever introduce a non-essential cookie category, it will be off by default and set only after you explicitly opt in through a consent banner that:
- lists each category separately with a plain-language purpose (granular consent),
- has no pre-ticked boxes,
- makes "refuse all" exactly as easy as "accept all",
- never blocks access to the service if you refuse (no cookie walls),
- records your choice (and its timestamp/version), and
- lets you change or withdraw your choice at any time via "Cookie settings" in the application footer. Withdrawing is as easy as giving consent.
3. Cookies we use
| Cookie | Category | Purpose | Duration | Consent |
|---|---|---|---|---|
oktra_session |
Strictly necessary | Keeps you signed in; holds your identity token. Secure, HttpOnly, SameSite=Lax | Session (inactivity timeout 30 min; absolute cap 12 h) | Not required (exempt: strictly necessary for the service you request) |
oktra_refresh |
Strictly necessary | Securely extends your signed-in session so you are not asked to re-authenticate continuously. Secure, HttpOnly, SameSite=Lax | Session (up to the 12 h absolute cap) | Not required (exempt) |
oktra_csrf |
Strictly necessary | Protects forms and connection flows against cross-site request forgery. Secure, HttpOnly, SameSite=Lax | Session | Not required (exempt) |
oktra_oidc_tx |
Strictly necessary | One-time value that secures the sign-in redirect (login state, nonce, PKCE verifier); set at the start of sign-in and cleared the moment it completes. Secure, HttpOnly, SameSite=Lax | A few minutes, during sign-in only | Not required (exempt) |
| Hosting/security cookies set by our platform (e.g. deployment access protection on non-production environments) | Strictly necessary | Infrastructure security | Short-lived | Not required (exempt) |
| Analytics | - | None in use | - | Would require prior opt-in |
| Marketing / advertising | - | None in use, none planned | - | Would require prior opt-in |
This table is updated whenever the service's cookie usage changes, before the change goes live.
4. EU/EEA/UK (ePrivacy Directive and GDPR)
Strictly necessary cookies are exempt from consent (ePrivacy Art. 5(3)). For any other category we rely on consent meeting the GDPR standard: freely given, specific, informed, and unambiguous, given before the cookie is set, and withdrawable at any time without detriment. Consent records are retained as evidence.
5. United States (state privacy laws)
We do not sell personal information and do not share it for cross-context behavioral advertising (as defined by CCPA/CPRA). Because no such sale/sharing occurs, no "Do Not Sell or Share" mechanism is currently required - but we honor Global Privacy Control (GPC) signals: where a GPC signal is present, non-essential cookies (if any existed) are treated as refused.
6. Managing cookies yourself
You can also control cookies in your browser (block, delete, or restrict them). Blocking strictly necessary cookies will prevent sign-in from working - they are the mechanism that keeps your session secure.
7. Changes
Changes are posted on this page with a new version number; material changes are announced in the application. Non-essential categories are never enabled without the opt-in flow of §2.
8. Contact
Oktra - privacy@oktra.ai