How Oxyide uses cookies

Cookies are small text files that a website asks your browser to store. They are commonly used to remember a signed-in session, remember preferences, or measure how a site is used.

This page explains exactly which of these situations applies — if any — to the Oxyide website.

Marketing pages — the homepage, FAQ, documentation and legal pages — set no cookies.

Account pages (login, registration, password flows, dashboard) set two strictly necessary first-party cookies described in sections 03 and 05. They exist only to keep you signed in securely.

There is no analytics, advertising or marketing technology on these pages, so no measurement or advertising cookies are set.

oxyide_csrf — a random token used to verify that account forms (login, registration, password changes) were submitted by this browser and not by another site. Readable by site scripts by design, never used for tracking, expires after 30 days of inactivity at the latest.

This cookie is set on the first visit to an account page and refreshed on each form submission. It is a double-submit CSRF token: the server issues the token, the browser stores it in the cookie, and the client echoes it in a custom request header (`x-csrf-token`). The server validates the match before processing any state-changing request.

The cookie is not HttpOnly (so JavaScript can read it for the header), Secure in production, SameSite=Lax, and scoped to the current host only.

Your light/dark theme choice is remembered in your browser's local storage under the key `oxyide-theme`, managed by the theme library used on this site.

Local storage is not a cookie: it stays in your browser, is not sent with requests, and is not readable by other sites. An interface preference such as a collapsed sidebar is stored the same way.

Clearing site data in your browser resets these preferences — the site falls back to the default dark theme.

oxyide_session — an opaque random token that identifies your signed-in session. It is HttpOnly (invisible to site scripts), SameSite=Lax, and Secure on production HTTPS. It lives for 30 days and is cleared when you log out. The server stores only a cryptographic hash of this token, never the token itself.

When you sign in, the server creates a session record, hashes the token with Argon2id, and stores only the hash. The plaintext token is returned in a Set-Cookie header. On each request, the server hashes the presented cookie and compares it to the stored hash — the plaintext token is never persisted.

Sessions are bound to the user account. A user may have multiple concurrent sessions (e.g., browser + mobile). Each session is independently revocable from the account settings page.

None. The Oxyide website loads no third-party analytics, no advertising pixels, no social embeds and no external media — so no third-party cookies are set.

You can block or delete cookies in your browser's settings at any time. Blocking the account cookies will sign you out and prevent login, registration and password flows from working; marketing pages are unaffected.

To forget your theme preference, clear the site's local storage data from your browser; the site will return to its default theme.

This page is updated whenever cookie usage changes. The authentication cookies above were introduced with account support; each future change will be described here before it takes effect.

Questions about this policy can be sent through the contact form on the support page.

Contact Oxyide support