Cookies and browser storage

What Ordimize stores in your browser

Cookies are small values sent with browser requests. Session storage is kept by your browser for a tab. The production app uses these values:

Sign-in session

__Host-ordimize_session keeps an authenticated session on the API domain. It is Secure, HttpOnly and SameSite=Lax, with no persistent cookie expiry set by Ordimize. Signing out clears it; the authentication provider also controls whether the session remains valid.

Sign-in protection

__Host-ordimize_login helps verify a sign-in return belongs to the request you started. It expires after ten minutes and is cleared on return.

Google Drive connection protection

__Host-ordimize_drive helps verify a Google Drive authorization return. It expires after ten minutes and is cleared on return. It is used only when Google Drive connection is available and initiated.

Invitation handling

ordimize_invite in session storage temporarily preserves your invitation during same-tab sign-in. It is removed after successful acceptance or when the app clears the invitation; your browser normally clears session storage when the tab is closed.

The security cookies are not advertising identifiers. Our newsletter form does not use a marketing cookie to subscribe you.

Third-party pages and resources

Hosted sign-in and Google consent or Picker interfaces are provided by WorkOS and Google. Those services may use their own cookies or browser storage under their own policies. Website hosting and external font or interface resources also process the network information required to serve requests.

Read the Privacy Policy for the service providers and information involved. We will update this page if we introduce additional storage uses.

Your controls

You can inspect, block or clear cookies and site data through your browser settings. Clearing authentication data signs you out; blocking essential cookies can prevent sign-in, invitation acceptance or storage connection from working.

Browser clearing does not delete server-side account or workspace records, revoke a storage provider's authorization, or unsubscribe an email address. Use Data Requests for those actions. Different browser privacy and restore settings can affect how long session data remains.