1. What cookies are
Cookies are small records that a website asks a browser to store and return. Similar technology includes local browser storage and temporary session storage. These tools can remember a session, protect a request, preserve a preference, or support a service you choose to use.
2. How Onelacks uses them
- Essential session and security storage. When you sign in, our server sets access_token and refresh_token (sign-in tokens that JavaScript cannot read; they persist for up to seven days unless you unticked "Remember me" at sign-in, in which case they end when the browser closes), ol_role (your account type, used only to route you to the right console), onelacks_device (a pseudonymous browser token, kept for up to a year, that lets us alert you about a sign-in from a new device), and csrftoken (cross site request protection). Staff who use the administration site also receive a sessionid cookie that ends when the browser closes.
- Browser storage set by the Onelacks app. Local storage keeps a cached copy of your account profile (user) so pages load before the server answers, your light or dark theme (onelack_theme), the page to return to after sign in (redirectAfterLogin), and session-expiry flags. Session storage, which clears when the tab closes, keeps an in-progress service request or booking draft, the category you were requesting, and which content banners you dismissed.
- Stripe payment storage. Payment pages load Stripe.js from Stripe. Stripe may set its own cookies (for example __stripe_mid and __stripe_sid) to prevent fraud, display secure payment fields, save a card at your request, and process an authorization or payment. Onelacks does not receive complete card numbers.
- Google sign in storage. If you choose Continue with Google, you are sent to Google, which may use its own cookies to authenticate you, show consent, and return the result to Onelacks.
- Google Maps storage. Pages with an address field load the Google Maps JavaScript API for address suggestions. Google may set its own cookies and receives the address text you type and your IP address under its own terms.
- Operational diagnostics. When a deployment configures Sentry, error reports are sent from your browser to Sentry without setting a cookie on Onelacks; the reports pass through a filter that removes user identity, request data, cookies, and headers and redacts most messages. The filter reduces, but cannot guarantee the absence of, personal information in a report. Our hosting services may use technical identifiers to keep the service reliable.
- Analytics, only where configured. A deployment may enable page-view analytics through Plausible, which uses no cookies, or Google Analytics 4, which sets Google analytics cookies such as _ga. Neither is used for advertising, and neither is loaded unless it is configured for that deployment.
3. What we do not use
Onelacks does not currently place advertising cookies or cross site tracking cookies and does not use cookie data for targeted advertising.
The only third party cookies come from the services named above, on the pages that use them. If that practice changes, we will update this policy and provide any consent control required by law before using the new category.
4. Your browser controls
Most browsers let you view, delete, or block cookies and clear local storage. Blocking essential storage may prevent account sign in, security checks, social sign in, booking, or payment. You can often allow storage for Onelacks while blocking it elsewhere. Browser help pages explain the controls for your device.
For more information about the personal information connected to these tools, read the Privacy Policy.
5. Changes and contact
We may update this policy when our technology or vendors change. A new version is posted on this page with its version and effective date from our published record.
Questions may be sent to support@onelacks.com.
[TODO-LLC: legal company name and mailing address]