← Back to Arkathos

Cookie Policy

Arkathos by TheApexFrameworkLLC  |  Effective Date: July 27, 2026  |  Version 1.0

1. What we use cookies for

Current posture:

• arkathos.com (marketing site): the marketing site sets no cookies and runs no analytics or tracking, with one exception: the /activate checkout page loads Stripe.js (our payment processor's script) to power secure card entry, and Stripe sets its own fraud-prevention cookies on that page — __stripe_mid (persists for approximately one year) and __stripe_sid (expires after approximately 30 minutes). Stripe uses these cookies for fraud detection and prevention, not for advertising or cross-site tracking; see Stripe's Cookie Policy for details. Separately, Cloudflare may set transient session cookies for DDoS protection / bot challenge; these do not identify users.
• app.arkathos.com (the app): One cookie of our own: a first-party product-analytics cookie, alog_vk (a visitor key) — a random identifier set by our self-hosted product-analytics suite, subject to the consent behavior in Section 4, so we can understand how the app is used and thereby fix bugs and improve it. alog_vk is a first-party cookie scoped to the app subdomain; it is not shared with, and does not enable, any third-party analytics service or cross-site tracking. Signing in does not use cookies — your sign-in session token is kept in browser local storage (see Section 3). When Cloudflare Turnstile bot protection is active on the signup and sign-in pages, Cloudflare may set its own transient challenge cookies there (see Section 2).

2. Third-party cookies

• Stripe — fraud-prevention cookies on the arkathos.com/activate checkout page, as described above.
• Cloudflare Turnstile — bot protection on the app's signup and sign-in pages. When active, Cloudflare may set transient challenge cookies there to distinguish humans from automated traffic; they do not identify you and are not used for advertising.

3. Local storage (not cookies)

We also use your browser's local storage — a device-local, functional mechanism that is not sent to other websites and is not used for cross-site tracking — for: your theme choice, language preference, accessibility settings, your sign-in session token, and your session-recording consent choice. Notable entries include arkathos.token (your workspace sign-in session token), portalSession (client-portal visitor session token), arkathos.recordingConsent (your session-recording consent decision), and theme, language, and accessibility preference keys. All are functional; none are used for advertising or cross-site tracking. The product-analytics visitor key (alog_vk) described in Section 1 is a first-party cookie rather than a local-storage entry; like these local-storage items, it stays first-party and is never used for cross-site tracking.

4. Cookie consent and your choices

Our consent experience depends on your region:

• United States: You see a one-time cookie banner explaining that we use cookies, first-party self-hosted product analytics, and session replay to operate and improve the Service, with links to this Cookie Policy and our Privacy Policy. Analytics is on by default, and you can opt out at any time in your account Settings. We honor the browser Global Privacy Control (GPC) signal as an opt-out wherever it is present.
• EU / UK / EEA: Consistent with the ePrivacy Directive and the UK PECR, the product-analytics cookie (alog_vk) and analytics beacon are not set until you give prior opt-in consent. Essential authentication cookies, which are strictly necessary to sign in, are always set. You can withdraw consent at any time.

Declining or withdrawing analytics consent does not affect your ability to sign in or use the Service.

5. Questions

Email [email protected].