OmniStore Cookie Policy

Effective Date: June 1, 2026 Last Updated: May 24, 2026 Version: 1.0.0

This Cookie Policy explains what cookies OmniStore uses, what they do, and the choices available to you. It complements the OmniStore Privacy Policy at useomnistore.com/legal/privacy, which covers our use of personal data more broadly.

A cookie is a small text file that a website stores on your device when you visit. Cookies let a website remember things about you between visits, like your authentication state or your language preference. They are widely used to make websites work, or to work more efficiently.

Some cookies are set by the website you’re visiting directly (“first-party cookies”). Others are set by services the website embeds - analytics, advertising networks, social-media widgets - and those are called “third-party cookies”.

This policy describes only first-party cookies set by OmniStore. As of the date of this policy, OmniStore does not embed any third-party services that set cookies in your browser. If that changes, this policy will be updated and (where required under EU ePrivacy law) you will see a consent banner before the new cookies are set.

2. What cookies OmniStore uses

OmniStore today sets exactly one cookie:

Name	Set by	Purpose	Category	Duration	HttpOnly	Secure	SameSite
`os_refresh`	`api.useomnistore.com`	Authentication refresh token. Lets the admin app keep you logged in across browser sessions without storing the token in JavaScript-accessible storage. Required to use the admin app.	Strictly necessary	90 days from last use	Yes	Yes (in production)	Lax

That’s it. No analytics cookies, no marketing cookies, no third-party cookies, no advertising-network cookies, no social-media pixels.

2.1 What “strictly necessary” means

A “strictly necessary” cookie is one without which the site cannot reasonably function. The os_refresh cookie is strictly necessary because without it, you would have to log in again every time you closed your browser tab - the access token that authenticates each API call is held only in your browser’s memory and is lost when the page unloads. The refresh cookie lets the admin app silently obtain a new access token when needed.

Under EU ePrivacy law (Directive 2002/58/EC, as amended), strictly-necessary cookies do not require prior consent because they are necessary to provide the service you’ve explicitly requested.

2.2 Storefront subdomains

When you visit a merchant’s storefront at {merchant-slug}.useomnistore.com, no OmniStore cookies are set in your browser. Storefronts are unauthenticated and don’t need an authentication cookie. The merchant operating the storefront may set their own cookies through their own integrations (analytics, payment widgets), but those are the merchant’s responsibility, not ours. Their privacy policy will tell you what they set.

3. Cookies we don’t use (yet)

We don’t currently use:

Analytics cookies (Google Analytics, Plausible, Matomo, etc.).
Advertising cookies (Google Ads, Meta Pixel, etc.).
Social-media widget cookies (Twitter, Facebook, LinkedIn share buttons).
Marketing-automation cookies (HubSpot, Intercom, Drift, etc.).
Session replay tools (Hotjar, FullStory, LogRocket, etc.).
A/B testing cookies (Optimizely, Google Optimize, etc.).

If we ever add any of these - for example, an analytics tool to understand how merchants use the admin app - we will:

Update this Cookie Policy with the cookie name, purpose, duration, and category.
Show a cookie consent banner on first visit, where required by law (EU/EEA + UK + Switzerland under ePrivacy + GDPR; some US states under CCPA’s “limit use of sensitive personal information” right).
Let you choose whether to accept optional categories before any optional cookie is set.

4. Local storage and similar technologies

In addition to cookies, browsers offer other client-side storage mechanisms: localStorage, sessionStorage, IndexedDB. OmniStore uses these as follows:

localStorage - the admin app stores a “pending logout” flag and a cached snapshot of the most recently logged-in user. The cached user is used at app boot to render the shell optimistically while we wait for the server to confirm the session. Cleared on logout. Not personal data shared with anyone; lives only in your browser.
sessionStorage - used incidentally by libraries the app depends on (Angular Material’s overlay system, etc.) but not for any business-critical purpose.
IndexedDB - not used.

These technologies don’t transmit data to OmniStore servers automatically the way cookies do. They are not subject to the same EU ePrivacy consent rules as cookies, but we describe them here for transparency.

5. How to control cookies

5.1 In your browser

Every modern browser lets you view, block, or delete cookies through its settings. Common paths:

Chrome: Settings → Privacy and security → Cookies and other site data.
Firefox: Settings → Privacy & Security → Cookies and Site Data.
Safari: Settings → Privacy.
Edge: Settings → Cookies and site permissions.

Blocking the os_refresh cookie specifically will mean you have to log in to the OmniStore admin every time you close the browser. The platform will still function; it will just be more annoying.

5.2 “Do Not Track” signals

Some browsers offer a “Do Not Track” (DNT) setting. Because OmniStore does not track you across the web for advertising or analytics, DNT has no meaningful effect on our handling of your data - we already don’t do the things DNT is meant to prevent.

5.3 Global Privacy Control

For California residents: Global Privacy Control (GPC) is a browser-level signal that opts you out of the sale or sharing of your personal information. OmniStore does not sell or share personal information, so GPC has no meaningful effect either; we honour the signal in the trivial sense that we already don’t do the things GPC is meant to prevent.

We may update this Cookie Policy from time to time. Version history is maintained in CHANGELOG.md in the OmniStore legal documents repository. Material changes (adding analytics cookies, adding third-party cookies, etc.) will be communicated 30 days in advance by email + in-app banner, and a fresh consent banner will appear if EU ePrivacy law requires it.

7. Contact

Questions about cookies? Email legal@useomnistore.com.