Draft prepared for attorney review. These documents are first drafts: they are not legal advice and have not been adopted by Varrock Inc. Points awaiting a business decision are marked [DECISION: …] and points for counsel [COUNSEL: …]; nothing here is in force.

Cookie and Local Storage Statement — oasisgui.com

Effective: [DECISION: publication date] · Version 1.0

This is a draft prepared on 2026-10-06 for review by counsel. It is not legal advice and has not been approved for publication. Every statement about what the website does was checked against the website source in this repository (website/, src/demo*.ts) and against the live site's response headers on that date; section 4A (the documentation portal's cookie) was verified the same day against the portal's source, delivered in the same change set (portal/src/auth.ts: issueAnonSession, sessionCookie, loadSession; portal/src/routes/auth.ts; portal/src/config.ts), and must still be checked against the live Set-Cookie header once the portal is deployed. Points that need an owner's or attorney's decision are marked [DECISION: …] or [COUNSEL: …] and are collected in section 12.

1. Who we are and what this statement covers#

1.1 This statement is issued by Varrock Inc., a Delaware corporation ("Varrock", "we", "us"), which operates the website at oasisgui.com (the "Site"), including the enterprise documentation portal under /docs/ with its sign-in pages (/signup, /login, /logout, /account, /admin — the "Portal"), the legal pages under /legal/, the download directory under /downloads/ and the in-browser product demo under /demo/.

1.2 It explains which cookies and similar technologies the Site uses, why, and how you can control them. It supplements our Privacy Policy, which describes what personal data we process and your rights, and our Terms of Service. This document is the "Cookie Statement" referred to in those documents. If this statement and the Privacy Policy differ on a point about cookies or browser storage, this statement governs that point.

1.3 This statement covers the Site only. It does not cover the Oasis desktop application, the OasisNet mesh software or the Oasis Mobile app, which run on your own devices and are described in the Privacy Policy.

1.4 This statement is an information notice about what the Site stores on your device. It is not a contract and does not limit any right you have under the data-protection or consumer law of your country. Disputes about the Site are governed by the Terms of Service, section 18, including its provisions for consumers in the EU, EEA and UK. [COUNSEL: the Terms currently list this statement among the incorporated agreement documents (Terms §20.1); confirm whether it should instead be 'referenced', consistent with its character as a notice.]

2. Definitions#

2.1 "Cookie" means a small text file that a website asks your browser to store and to send back on later requests to that website.

2.2 "Local storage" means the localStorage and sessionStorage areas of your browser (together with IndexedDB and similar browser-side stores) in which a website can keep data on your device. Unlike a cookie, data in local storage is not sent to the server automatically; a page can only read it with its own script.

2.3 "Similar technologies" means any other method of storing information on, or gaining access to information already stored on, your device, as that phrase is used in Article 5(3) of Directive 2002/58/EC (the "ePrivacy Directive") and regulation 6 of the UK Privacy and Electronic Communications Regulations 2003 ("PECR").

2.4 "Strictly necessary" has the meaning given in Article 5(3) of the ePrivacy Directive: storage or access that is strictly necessary in order to provide an information-society service explicitly requested by the user.

3. The short answer#

3.1 No public page of the Site sets a cookie. No first-party cookie and no third-party cookie is set by the home page, the legal pages, the download directory, the demo or the public landing page of the documentation portal, and there is no analytics, advertising, A/B-testing or session-tracking code anywhere on the Site. This includes cookies set by our web servers: neither the site container nor the front web server that terminates TLS sends a Set-Cookie header on those pages (verified against the live site on the date above). [DECISION: re-verify with curl -I https://oasisgui.com/` and /demo/ at publication and after any change to the front web server, reverse proxy or hosting; adding a CDN or bot-protection layer that sets cookies would require this statement to be updated first.]`

3.1a The Site sets exactly one cookie, and only on the Portal. The cookie oasis_portal_session is first set when you open the Portal's sign-in or sign-up page. At that point it holds an anonymous random value; nothing about it is stored on our side, and its only job is to make sure that the form you then submit came from your own browser (anti-forgery). In that state it is a browser-session cookie — your browser discards it when you close it — and we stop accepting it 24 hours after it was set. When you create an account or sign in, it is replaced by a sign-in token so that the Portal knows, on your next request, that you are the person who signed in; that token lasts up to 30 days and is removed when you sign out. It is a strictly necessary cookie in both states (section 7.2a); it is set by our own server and holds nothing about you. Section 4A describes it. The public landing page at /docs/, the documentation pages themselves and every other page of the Site set no cookie; if you never open the sign-in or sign-up page, this cookie is never set.

3.2 The Site's own pages store one item in local storage, and only if you ask them to: your colour-theme choice (section 4).

3.3 The live demo on the home page is our own software served from our own domain. It loads no third-party content. Because it is the full Oasis application running in your browser, it keeps its own user-interface state — and, if you type into its settings, notes or to-do fields, what you typed — in local storage on the same domain, where it stays until you clear site data (section 5).

3.4 No consent banner is shown. In our assessment (section 7) nothing the Site stores on your device requires consent under the ePrivacy Directive or PECR, because each item — the theme key, the demo's working state and the Portal's sign-in cookie — is strictly necessary for something you asked the Site to do. We tell you about it here instead. [COUNSEL: this conclusion depends on the section 7.2, 7.2a and 7.3 markers; do not publish until they are closed.]

4. Local storage the Site itself uses#

4.1 The pages of the Site (home page and documentation pages) use exactly one local-storage key:

Key Set when Value Purpose Lifetime Category
oasis-site-theme Only when you click the "Toggle colour theme" button and choose dark or light. It is not set on a normal visit. "dark" or "light" Remembers your colour-theme choice so the next page applies it before first paint instead of flashing the system default. No built-in expiry: until you clear it or choose auto again, which deletes the key. Strictly necessary / user preference (section 7).

4.2 How this works, in plain terms: the theme button cycles auto → dark → light → auto. In auto the Site follows your operating-system setting and stores nothing. Choosing dark or light writes the key; returning to auto removes it. The key is read once, at the top of each page, and is never sent to our server or to anyone else. Every read and write is wrapped so that, if your browser blocks site data (for example, in a private window), the Site still works and simply does not remember your choice.

4.3 The Site does not use sessionStorage, IndexedDB, Web SQL, the Cache API, service workers, fingerprinting techniques or any other similar technology on its own pages.

4.4 Every page of the Site (home page and documentation pages) fetches the file /downloads/latest.json from our own server; the home page uses it to label the download buttons with the current version. That is an ordinary same-origin request; it stores nothing on your device and, since the Site has no cookies, it carries none. The container web server that serves the Site does not write access-log lines for this manifest or for download files; whether the front web server records them is being confirmed, and any such logs are described in the Privacy Policy section 5.1, not here, because they are server-side records rather than anything stored on your device.

4A.1 The enterprise documentation under /docs/ is available only to the users of approved enterprise customers (the Privacy Policy, section 5.7, describes the account, the company approval and what we keep about you). To tell your signed-in browser apart from every other browser, the Portal uses one cookie:

Name Set when Value Purpose Lifetime Attributes Category
oasis_portal_session (before you sign in) When you open the sign-in page (/login) or the sign-up page (/signup). Not set by the public landing page at /docs/ or by any other page of the Site. An anonymous random value prefixed with the time it was issued. It is not derived from anything about you, and our server stores nothing about it — no record and no IP address; the form's anti-forgery token is computed from it with a server-side key. Lets the Portal reject a sign-in or sign-up form that was not loaded by your own browser (anti-forgery). It does not identify you and is not used to recognise you on a later visit. A browser-session cookie: no Max-Age or Expires, so your browser discards it when you close it. Our server refuses it 24 hours after issue and sends a fresh one when you open the form again. HttpOnly, Secure, SameSite=Lax, Path=/. Strictly necessary — security of a form you requested (section 7.2a).
oasis_portal_session (after you sign in) When you create an account or sign in; it replaces the value above. A random 32-byte token encoded as text. It is not derived from anything about you; our server keeps only a keyed one-way hash of it (HMAC-SHA256), which it matches against the cookie on each request. Keeps you signed in between page loads so that the Portal can serve the documentation your company is approved for, show your account status, and reject state-changing requests that did not come from your own session (anti-forgery). Up to 30 days from sign-in, cut short by signing out, by 7 days without a request, by an administrator deleting your account, or by the token being invalidated on our side (for example after a password reset). The browser is told the same 30-day expiry (Max-Age=2592000), so the cookie survives closing the browser; see the counsel marker in 7.2a. HttpOnly (no page script can read it), Secure (sent over HTTPS only), SameSite=Lax (not sent on cross-site form posts), Path=/. Strictly necessary — authentication (section 7.2a).

4A.2 How this works, in plain terms: when you sign in, the Portal creates a random token, stores a hash of it with your account and the time, and sends the token to your browser in the cookie. On every later request your browser sends the cookie back; the Portal hashes it, finds the session, and knows you are signed in and which company you belong to. When you sign out, the session is deleted on our side and the cookie is cleared, so a copy of the old cookie no longer works. The cookie carries no name, email address, company or preference; all of that stays in the Portal's database, where it is described in the Privacy Policy.

4A.3 What is not a cookie. The anti-forgery (CSRF) token that every Portal form carries is written into the form as a hidden field, not stored on your device. The Portal's pages use the same oasis-site-theme local-storage key as the rest of the Site (section 4) and nothing else. The Portal sets no analytics, preference, tracking or third-party cookie and loads no third-party content.

4A.4 Server-side records that accompany the cookie. Each sign-in and each administrator action is recorded with your IP address and the time in an audit log, and sign-in and sign-up attempts are counted per IP address and per email address for a short window to slow down password guessing. Those are records on our server, not storage on your device; the Privacy Policy, section 5.7, states what they contain and how long they are kept.

5. The live demo embed#

5.1 What it is. The "See the whole workspace move" section of the home page contains an <iframe> whose content is https://oasisgui.com/demo/: a build of the Oasis desktop application compiled to run in a plain web browser with a fictional fleet of servers, sessions and terminal output. It is served from the same domain as the Site, by us. It is not a video platform, an embedded third-party widget or a hosted sandbox from another provider.

5.2 When it loads. On wider screens the frame is loaded automatically as you scroll near it. On phones and other narrow screens a static poster is shown instead and the demo loads only if you tap "Load it here instead" or open /demo/ in a full page. The frame is marked referrerpolicy="no-referrer".

5.3 What it connects to. The demo has no backend. The application's calls to its native backend are intercepted by a browser shim that answers them from bundled fixtures. We found no network request to any third party in the demo code, and the demo bundle loads its fonts and other assets from oasisgui.com. The desktop application's update check (described in the Privacy Policy) is part of the native application and cannot run inside the browser demo.

5.4 What it stores. Because the demo is the full application's user interface, it reuses the application's own habit of keeping pieces of interface state in local storage. The demo's "write barrier" stops it from saving any application state to disk through the backend, but it does not intercept the browser's local storage. The two keys that would record a look-and-feel or experience profile are deliberately not written in demo mode; other keys are not gated and may be written on the oasisgui.com origin when the demo runs. In the source as of the date above we identified the following keys that the demo writes without any input from you:

Key (local storage) What it holds Written when
oasisDesktopLayoutV A version number of the internal desktop-layout model. After the demo finishes its initial load.
oasisGreeterLastActive A timestamp of the last interaction, used to choose a greeting message. While the demo is open.
oasis.gettingStarted.collapsed Whether the getting-started checklist is folded. Only if you fold or unfold the checklist.
oasis-presence-client-id:… A random identifier for this browser window, used by the shared-desktop presence feature. When that feature initialises.

(oasis.changelog.lastSeenVersion, which the desktop application writes, is not written by the browser demo; the version call it keys on is unanswered there.)

Other oasis-prefixed keys of the same character (view-mode preferences, snooze timestamps, a cache of machine appearance data) exist in the application and could be written if the corresponding part of the interface is used inside the demo. The demo may also use sessionStorage for a short-lived internal hand-off; that store is cleared when the tab is closed. [DECISION: before publication, run the demo in a clean browser profile, enumerate every key it writes on the oasisgui.com origin and either list them here verbatim or gate the writers behind the demo flag so that the table above is exhaustive. The ungated writers found in the source are: oasis:session-todosandoasis:session-agent-chat(src/stateTodos.ts),oasis:session-stickies(src/stateStickies.ts),oasis:openrouter-key(src/openrouterKey.ts, written on every keystroke by src/SettingsModal.tsx),oasis:voice-settingsincluding an ElevenLabsapiKeyfield (src/stateVoiceSettings.ts),oasis:browser-agent-chatand the Android agent chat (src/stateBrowserAgent.ts, src/stateAndroidAgent.ts),oasis.meshPerson(src/stateAmbientPresence.ts),oasis-presence-client-id:…(src/stateSharedDesktops.ts),oasis.machineAppearance.v1(src/stateMachineAppearance.ts) andfilePanel:* (src/stateFilePanelCache.ts); none of these files consults the demo flag. Either gate them behind the demo flag, or disable storage for the demo build (section 5.6); until one of those is done this statement cannot claim that the demo stores no personal data, and section 5.5 must stay as written.]

5.5 What the listed keys are, and what else the demo can store. The keys in the table above hold a version number, timestamps, a folded/unfolded flag and a random per-window identifier; none of them identifies you or your device to us, and they are internal working state of the demo you are viewing. Whether that is "strictly necessary" in the ePrivacy sense is addressed in section 7.3. Beyond those keys, the demo can store, in your browser only, what you type into it — per-session notes, to-do lists, assistant chat history, a display name entered for shared-desktop presence, and any API key you paste into its settings (for example an OpenRouter key under Settings → To-dos, or an ElevenLabs key under voice settings) — under oasis:- or oasis.-prefixed keys, exactly as the desktop application would keep them. Nothing in local storage is read by, or transmitted to, Varrock or any third party; it stays on your device until you clear site data for oasisgui.com (section 9) or until the demo itself changes or removes it. [DECISION: before publication, either gate these writers behind the demo flag (so the demo stores nothing you type) or keep this paragraph and the enumeration required by the section 5.4 marker.]

5.6 [DECISION: consider adding a sandboxattribute (withoutallow-same-origin) to the demo iframe, or having the demo build disable browser storage, so that the embedded demo stores nothing on the Site's origin and sections 5.4-5.5 can be reduced to "the demo stores nothing". This is a product choice; the application's shared-desktop and tour features inside the demo should be tested under it.]

6. Third-party content and embeds#

6.1 None. The pages of the Site load scripts, stylesheets, fonts, images and the Mermaid diagram renderer used on documentation pages from oasisgui.com only. No tag manager, analytics script, social-media pixel, chat widget, comment system, map, video player or web-font service is embedded, and the Site is served directly by our own web servers without a third-party content-delivery network. [DECISION: confirm that no CDN or proxy (at the DNS level or on the front web server of the host) sits in front of oasisgui.com and injects cookies — DNS and the front-server configuration are outside the repository, so this could not be verified in code; the live response headers on the date above showed a plain nginx front and no CDN headers.] [DECISION: the committed version of the home page that was live before the current redesign loaded fonts from Google Fonts (fonts.googleapis.com/fonts.gstatic.com), which transmits the visitor's IP address to Google. The working-tree redesign uses system fonts. Confirm which version is live at publication; if Google Fonts are retained, this section must disclose that request and counsel should consider the consent position (see LG München I, 3 O 17493/20, 20 January 2022).]

6.2 Outbound links. The Site links to our X (Twitter) profile at x.com/oasisgui and to the mailbox sales@oasisgui.com. Following a link takes you to that third party's service, which is governed by its own cookie and privacy practices; nothing is loaded from those services while you remain on the Site.

6.3 Downloads. Files under /downloads/ are served directly by our own web server. Downloading a file stores nothing on your device other than the file you chose to download.

7.1 The rule. Article 5(3) of the ePrivacy Directive, as transposed in each EU Member State (and PECR regulation 6 in the UK), requires the user's consent before information is stored on, or accessed from, the user's terminal equipment, with two exemptions: (a) storage or access for the sole purpose of carrying out the transmission of a communication, and (b) storage or access that is strictly necessary to provide an information-society service explicitly requested by the user. The rule is technology-neutral: the Court of Justice confirmed in Planet49 (C-673/17, 1 October 2019) that it applies regardless of whether the stored information is personal data, and the European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3) confirm that it reaches local storage and similar technologies, not only cookies.

7.2 How it applies to the theme key. The oasis-site-theme key is written only in response to your own, explicit action of choosing a theme, and its sole function is to carry out that request on the next page. Supervisory guidance has long treated storage that remembers a user-interface choice the user made (language, display preferences, and the like) as falling within the strictly-necessary exemption (Article 29 Working Party Opinion 04/2012 on cookie consent exemption, section 3.6 "UI customisation cookies"). On that basis we do not ask for consent for this key; we disclose it here instead, which is the transparency the exemption still requires. The key has no built-in expiry: it remains until you change it or clear site data (section 9). [COUNSEL: confirm the strictly-necessary / user-preference reading for oasis-site-theme under the ePrivacy transpositions that matter most for the Site's audience (e.g. §25 TTDSG/TDDDG in Germany, Article 82 of the French Loi Informatique et Libertés and CNIL guidance) and under PECR regulation 6(4).] [COUNSEL: WP29 Opinion 04/2012 §3.6 contemplated session or short-lived persistent storage for UI-customisation; confirm an indefinite single-value preference key is acceptable under the transpositions that matter, or ask the site to re-write the key with a dated value and drop it after a fixed period, e.g. 12 months.]

7.2a How it applies to the Portal's cookie. You cause the oasis_portal_session cookie to be set by an explicit act — opening the sign-in or sign-up page of a service you have asked to use, and then submitting the form — and its only functions are to carry out what you asked for: first to protect the form you are about to submit against forgery (the pre-sign-in state, a browser-session cookie about which we store nothing), then to be recognised as the signed-in user on the Portal pages you then request. Authentication cookies are the paradigm case of the strictly-necessary exemption: Article 29 Working Party Opinion 04/2012, section 3.3 ("authentication cookies"), treats a cookie that identifies the user once logged in as exempt for the duration of the session, and Recital 66 of Directive 2009/136/EC gives "the provision of a service explicitly requested by the user" as the exemption's purpose. The cookie is HttpOnly, so no script on the page — ours or anyone else's — can read it, and the Portal uses it for nothing but authentication and anti-forgery. On that basis we do not ask for consent for it and disclose it here instead. [COUNSEL: WP29 Opinion 04/2012 §3.3 exempts session authentication cookies but says a persistent login cookie that survives the browser session ("remember me") is not strictly necessary unless the user explicitly asks for it. The code gives the signed-in cookie a Max-Age of 30 days (portal/src/auth.ts, sessionCookie), with a 7-day idle cut-off on our side; the pre-sign-in cookie has no Max-Age. Either (a) make the browser cookie session-scoped while the server-side session lasts 30 days, (b) add a "keep me signed in" checkbox and set the 30-day expiry only when it is ticked, or (c) take the position that signing in to a work portal is itself a request to be kept signed in for a reasonable period; confirm which, under the national transpositions that matter (§25 TTDSG/TDDDG, French Article 82 and CNIL guidance, PECR regulation 6(4)).] [COUNSEL: the anti-forgery token itself is carried in a hidden form field; the pre-sign-in cookie holds only the random value it is derived from, is set when the form page is opened (before any submission), is session-scoped, is stored nowhere on our side and is not used to recognise the visitor — confirm that it falls within the strictly-necessary exemption as a security measure for a form the visitor requested (WP29 Opinion 04/2012 §3.2, "user-input cookies", treats session cookies that secure a user's form input as exempt).]

7.3 How it applies to the demo's keys. The demo loads either automatically on wide screens or after your tap on narrow screens (section 5.2). Its storage keys serve the running of the demo you are viewing and nothing else, and no information is read back for any other purpose, so we take the same position for them. [COUNSEL: the automatic (scroll-triggered) load on wide screens means the demo may write to local storage without a click from the visitor; confirm whether that still fits "explicitly requested" or whether the load should be click-to-run everywhere, which would also simplify the analysis. Note that oasisDesktopLayoutVandoasisGreeterLastActive are written without any visitor choice, so the WP29 04/2012 §3.6 user-preference reasoning in 7.2 does not apply to them; the fallback is the general strictly-necessary limb, or the section 5.6 fix. The DECISION items in sections 5.4 and 5.6 would moot this point.]

7.4 United States. US federal law contains no general cookie-consent requirement. California's CCPA/CPRA regulates "sale" and "sharing" of personal information, including by cross-context behavioural advertising cookies; the Site has none. Whether Varrock is a "business" under the CCPA/CPRA [COUNSEL: determine against actual revenue and consumer counts — no figures are in the record]; in any event the Site sets no cookies and does not sell or share personal information, so no "Do Not Sell or Share" link and no Global Privacy Control handling is required; we nonetheless note that the Site's behaviour is the same whether or not a GPC signal is present.

7.5 If this changes. Adding analytics, embedded third-party media, a web-font service, a second cookie on the Portal for any purpose beyond authentication, or any other technology that stores or reads information on your device for a purpose beyond what you request would take the Site outside the exemption. We would update this statement and introduce a consent mechanism before doing so.

7.6 Switzerland. Article 45c(b) of the Swiss Telecommunications Act requires that you be informed about storage on your device and about how to refuse it; sections 4 to 6 and 9 of this statement provide that information. [COUNSEL: confirm; no consent requirement beyond information and opt-out is assumed.]

8. Server-side records that are not cookies#

8.1 For clarity: our web server may keep standard access logs (IP address, user-agent string, requested URL, time) when you load a page or a file. Logs are kept on our server, not on your device, and are not cookies or similar technologies. The access-log position and retention are stated once, in the Privacy Policy (sections 5.1 and 11); this statement makes no independent claim.

8.2 Likewise, the Portal's database — your account, your company's record and approval status, the hashed session that the cookie in section 4A points to, the audit log of sign-ins, account and company events and administrator actions with IP addresses, the per-address counters of failed or rejected requests, and the short-lived counters that rate-limit sign-in attempts per IP address and email address — is server-side storage and is described in the Privacy Policy, section 5.7, with its retention in section 11 there. The only thing the Portal places on your device is the cookie in section 4A.

9. How to see and clear what the Site has stored#

9.1 On the Site. Set the colour theme back to auto using any theme button; this deletes the oasis-site-theme key. On the Portal, use Sign out (in the sidebar of every documentation page and on your account page); this deletes the session on our side and clears the oasis_portal_session cookie, and any copy of the old cookie stops working at once. If you opened the sign-in or sign-up page but never signed in, closing your browser discards the cookie and there is nothing on our side to delete. Deleting the cookie in your browser without signing out (9.2) signs you out of that browser, but the session record on our side remains until it expires or you sign out; if you want it ended immediately, sign in and sign out, or ask us (Privacy Policy, section 18).

9.2 In your browser. Clearing "site data" or "cookies and site data" for oasisgui.com removes everything the Site and the demo have stored, including local storage. The setting is usually found under:

  • Chrome / Chromium / Edge / Brave: Settings → Privacy and security → Delete browsing data (tick "Cookies and other site data"), or Settings → Privacy and security → Site settings → View permissions and data stored across sites → search oasisgui.com → Delete.
  • Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → select oasisgui.com → Remove Selected.
  • Safari (macOS): Safari → Settings → Privacy → Manage Website Data → select oasisgui.com → Remove.
  • Safari (iOS/iPadOS): Settings → Apps → Safari → Advanced → Website Data → swipe oasisgui.com → Delete.

Menu names vary between browser versions; your browser's help pages describe the current location.

9.3 Inspecting directly. Any desktop browser's developer tools show the stored keys: Application (Chrome/Edge) or Storage (Firefox/Safari) → Local Storage → https://oasisgui.com.

9.4 Blocking. If you set your browser to block site data for oasisgui.com, the Site continues to work; it will not remember your theme between pages, and the demo will run without remembering its interface state or anything you typed into it. The one exception is the Portal: if your browser refuses the oasis_portal_session cookie you cannot stay signed in, so the enterprise documentation cannot be shown to you; everything else on the Site remains usable.

9.5 Private windows. In a private or incognito window, anything stored is discarded when the window is closed.

10. Changes to this statement#

10.1 We will update this statement whenever the Site's use of cookies or similar technologies changes and will show the effective date and version number at the top. Material changes, in particular the introduction of any technology that requires consent, will be announced on this page before they take effect, and earlier versions will remain available on request [DECISION: or at a /legal/cookie-statement/history page].

11. Contact#

11.1 Questions about this statement can be sent to [DECISION: contact mailbox — only sales@oasisgui.com exists today; decide whether it is the published contact for cookie and privacy questions or whether a dedicated mailbox will be created]. Varrock Inc. is a Delaware corporation; its registered agent is LegalInc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA. [DECISION: whether to print the registered agent's address as the postal contact, since no other company address is known.]

12. Open decisions#

The following markers appear in this draft and need an owner's [DECISION] or counsel's [COUNSEL] input before publication:

  1. [DECISION: publication date] — effective date in the title block.
  2. [COUNSEL: the Terms currently list this statement among the incorporated agreement documents (Terms §20.1); confirm whether it should instead be 'referenced', consistent with its character as a notice.] (section 1.4)
  3. [DECISION: re-verify with curl -I https://oasisgui.com/ and /demo/ at publication and after any change to the front web server, reverse proxy or hosting; adding a CDN or bot-protection layer that sets cookies would require this statement to be updated first.] (section 3.1)
  4. [COUNSEL: this conclusion depends on the section 7.2 and 7.3 markers; do not publish until they are closed.] — no-banner conclusion (section 3.4)
  5. [DECISION: before publication, run the demo in a clean browser profile, enumerate every key it writes on the oasisgui.com origin and either list them here verbatim or gate the writers behind the demo flag … The ungated writers found in the source are: … Either gate them behind the demo flag, or disable storage for the demo build (section 5.6); until one of those is done this statement cannot claim that the demo stores no personal data …] (section 5.4)
  6. [DECISION: before publication, either gate these writers behind the demo flag (so the demo stores nothing you type) or keep this paragraph and the enumeration required by the section 5.4 marker.] (section 5.5)
  7. [DECISION: consider adding a sandboxattribute (withoutallow-same-origin) to the demo iframe, or having the demo build disable browser storage, so that the embedded demo stores nothing on the Site's origin …] (section 5.6)
  8. [DECISION: confirm that no CDN or proxy (at the DNS level or on the front web server of the host) sits in front of oasisgui.com and injects cookies — DNS and the front-server configuration are outside the repository …] (section 6.1)
  9. [DECISION: the committed version of the home page that was live before the current redesign loaded fonts from Google Fonts … Confirm which version is live at publication; if Google Fonts are retained, this section must disclose that request and counsel should consider the consent position …] (section 6.1)
  10. [COUNSEL: confirm the strictly-necessary / user-preference reading for oasis-site-theme under the ePrivacy transpositions that matter most for the Site's audience … and under PECR regulation 6(4).] (section 7.2)
  11. [COUNSEL: WP29 Opinion 04/2012 §3.6 contemplated session or short-lived persistent storage for UI-customisation; confirm an indefinite single-value preference key is acceptable …, or ask the site to re-write the key with a dated value and drop it after a fixed period, e.g. 12 months.] (section 7.2)
  12. [COUNSEL: the automatic (scroll-triggered) load on wide screens means the demo may write to local storage without a click from the visitor; confirm whether that still fits "explicitly requested" … Note that oasisDesktopLayoutV and oasisGreeterLastActive are written without any visitor choice …] (section 7.3)
  13. [COUNSEL: determine against actual revenue and consumer counts — no figures are in the record] — CCPA/CPRA "business" status (section 7.4)
  14. [COUNSEL: confirm; no consent requirement beyond information and opt-out is assumed.] — Switzerland, Telecommunications Act Art. 45c(b) (section 7.6)
  15. [DECISION: or at a /legal/cookie-statement/history page] — where earlier versions are kept (section 10.1)
  16. [DECISION: contact mailbox — only sales@oasisgui.com exists today; decide whether it is the published contact for cookie and privacy questions or whether a dedicated mailbox will be created] (section 11.1)
  17. [DECISION: whether to print the registered agent's address as the postal contact, since no other company address is known.] (section 11.1)
  18. Resolved 2026-10-06 against portal/src/: a pre-sign-in cookie IS set when the sign-in or sign-up page is opened; it is anonymous, session-scoped, refused after 24 hours and stored nowhere on our side — now described in 3.1a and the first row of 4A.1 (sections 3.1a, 4A.1)
  19. Resolved by the code: 7-day idle timeout (portal/src/config.ts, sessionIdle) (section 4A.1)
  20. Resolved by the code: the signed-in cookie carries Max-Age=2592000 (30 days, persistent); the pre-sign-in cookie carries no Max-Age. The counsel point in 21 therefore stands as written (section 4A.1)
  21. [COUNSEL: WP29 Opinion 04/2012 §3.3 exempts session authentication cookies but says a persistent login cookie … is not strictly necessary unless the user explicitly asks for it … Either (a) make the browser cookie session-scoped …, (b) add a "keep me signed in" checkbox …, or (c) take the position that signing in to a work portal is itself a request …; confirm which …] (section 7.2a)
  22. [COUNSEL: the pre-sign-in cookie that carries the random value behind the anti-forgery token — session-scoped, stored nowhere on our side, set when the form page is opened — as a strictly-necessary user-input/security cookie under WP29 Opinion 04/2012 §3.2; confirm.] (section 7.2a)

Access logs (section 8.1) and the Portal's database (section 8.2) carry no marker here: the position and retention are decided once, in the Privacy Policy (its sections 5.1 and 11), and this statement defers to it. Sibling filenames verified on 2026-10-06: privacy-policy.md, terms-of-service.md.

Source trail for reviewers (repository paths, not for publication): no document.cookie anywhere under website/; live headers curl -sI https://oasisgui.com/ and /demo/ on 2026-10-06 — Server: nginx/1.30.1, no Set-Cookie, no CDN headers; theme key in website/index.html (inline head script), website/main.ts (THEME_STORAGE_KEY, applyMode; removeItem only on auto, no expiry) and website/build-docs.ts (docs-page head script, which also injects /main.js on every docs page); manifest fetch in website/main.ts (getLatestRelease, unconditional); demo iframe markup in website/index.html and loader in website/main.ts (live-demo block, IntersectionObserver sets iframe.src); demo runtime shim in src/demoWebRuntime.ts / src/demoWebRuntimeInstall.ts (app_version unanswered → WhatsNewGate.tsx never writes); demo write barrier in src/demoInvoke.ts (backend commands only, not localStorage); demo-gated keys in src/theme.ts and src/stateExperience.ts; ungated automatic keys in src/statePersistence.ts (migrateDesktopLayoutOnce), src/AppToolbarGreeter.tsx, src/stateGettingStarted.ts, src/stateSharedDesktops.ts (presence client id); ungated visitor-typed stores in src/stateTodos.ts, src/stateStickies.ts, src/openrouterKey.ts + src/SettingsModal.tsx, src/stateVoiceSettings.ts, src/stateBrowserAgent.ts, src/stateAndroidAgent.ts, src/stateAmbientPresence.ts, src/stateMachineAppearance.ts, src/stateFilePanelCache.ts (none imports isDemoMode); sessionStorage in src/identityProfileSwitchHandshake.ts; self-hosted Mermaid in website/build.sh; container access_log off for .json and installers in deploy/k8s/oasisgui.yaml; host-level front server and DNS not in the repository. Section 4A: the owner's portal/ specification of 2026-10-06 — cookie oasis_portal_session, 32-byte random token, SHA-256 hash stored server-side, 30-day expiry with idle checks, HttpOnly; Secure; SameSite=Lax; Path=/, CSRF token in a hidden field plus Origin/Referer check, rate limiting per IP and email in SQLite, audit log with IP; /docs/ landing page public; the portal is proxied by the host nginx for /docs/, /login, /signup, /logout, /account, /admin and the in-cluster static server returns 404 for /docs/ — verified against portal/src/auth.ts (issueAnonSession: cookie a.<issued-at>.<random>, no Max-Age; sessionCookie: Max-Age=2592000 for a signed-in token; loadSession: anonymous cookie refused after anonMaxAge = 24 h; destroySession is a no-op for the anonymous cookie, i.e. nothing stored), portal/src/routes/auth.ts (ensureSession on GET /login and /signup; stored session issued only on successful POST), portal/src/config.ts (sessionMaxAge 30 d, sessionIdle 7 d, anonMaxAge 24 h) and portal/test/flow.test.ts ("the sign-in page sets a browser-session cookie (no Max-Age) and stores nothing"); a curl -I https://oasisgui.com/login remains to be run once deployed.

Source: docs/legal/cookie-statement.md in the repository · draft for attorney review · 21 [DECISION] markers and 19 [COUNSEL] markers on this page.