Cookie Policy
This page lists every cookie the Occlusia website places on your device, what each one does, and how long it lasts. There are six, plus one entry in your browser's session storage. All of them are strictly necessary, none of them tracks you, and none of them is shared with anyone.
01
What this page covers
A cookie is a small file a website asks your browser to keep. The same rules cover equivalent techniques — local storage, session storage, tracking pixels, device fingerprinting — and this page accounts for all of them, not only for cookies in the strict sense.
It covers the occlusia.app website. The Occlusia application, at app.occlusia.app, is covered by its own documentation.
02
The cookies actually used
The complete inventory. Nothing outside this table is set by this site, and no third party sets anything on it at all.
| Name | What it does | Lifetime | Category |
|---|---|---|---|
occ_session | Holds the credential that keeps you signed in. Marked httpOnly, so no JavaScript can read it, and replaced with a fresh value every time it is used. | 60 days | Strictly necessary |
occ_entitlement | A short-lived signed proof of your plan and features, so pages can show what you are entitled to without querying the account API on every view. Also httpOnly. | 24 hours | Strictly necessary |
occ_account | A single character holding no personal data. It lets an already-cached page show “My account” instead of “Sign in” without waiting for the server. Readable by JavaScript by design, because there is nothing in it worth protecting. | 60 days | Strictly necessary |
occ_verify | Holds the registration token of an account whose email address is still being verified — one of the two proofs needed to activate it. Set when you sign up, removed once the account is active. | 24 hours | Strictly necessary |
occ_verify_email | Remembers which address the verification code was sent to, so the verification page can say where to look. | 24 hours | Strictly necessary |
NEXT_LOCALE | Remembers the language you picked in the footer so the site opens in it next time. | Browser session | Strictly necessary |
occ_verify_sent_at | Kept in session storage, not as a cookie. Remembers when the last verification code was sent, so the button that asks for a new one waits until another may be sent. | Until the tab is closed | Strictly necessary |
03
Why there is no consent banner
Because the law does not call for one here. Article 5(3) of the ePrivacy Directive — transposed into Belgian law by Article 129 of the Act of 13 June 2005 on electronic communications — requires your consent before anything is stored on your device, with a single exception: storage strictly necessary to deliver a service you have explicitly requested.
Everything in the table above sits inside that exception. Authentication cookies and interface-preference cookies such as a language choice are named as exempt in Opinion 04/2012 of the Article 29 Working Party on the cookie consent exemption, guidance the European Data Protection Board still applies. The security check's reading of your browser on the sign-in and sign-up pages rests on the same exception: the opinion counts mechanisms that protect a login against abuse among the exempt uses.
A banner could be shown anyway. It is not, because a banner offering to refuse cookies that cannot be refused — without them there is no signing in — would be theatre, and asking for consent that is not needed is discouraged precisely because it teaches people that the question is meaningless. You are told what is stored instead, which is what Article 13 GDPR actually requires.
04
What is deliberately absent
For completeness, none of the following exists anywhere on this site:
- No analytics or audience measurement of any kind — no Google Analytics, no Plausible, nothing. Which pages you read is not recorded.
- No advertising or retargeting cookies, and no advertising network.
- No social network buttons or social media embeds that would report your visit back to a platform.
- No device fingerprinting for tracking, and no cross-site tracking. Apart from the user-agent string your browser sends with every request — recorded with each session so you can recognise it under Account → Sessions — your browser is examined only by the security check on the sign-in and sign-up pages, described in the Privacy Policy.
- Nothing sold, brokered, or shared for anyone else's marketing.
05
Controlling cookies yourself
Every browser can list, block, and delete cookies, usually under Settings → Privacy. A private window discards them when it closes, and most browsers can be set to clear them on every exit.
One consequence is worth knowing before you do. Because all of them are essential, blocking them reduces no tracking — there is none to reduce — it simply prevents you from signing in and makes the site forget which language you read.
06
If this ever changes
Should Occlusia ever add something that is not strictly necessary — audience measurement, for instance — it will be described on this page before it ships, and your consent will be requested before it loads, with a refusal exactly as easy as acceptance and honoured for the whole visit. Until you see that change here, this page is the whole story.
07
Questions
What happens to the data behind these cookies — who sees it, how long it is kept, and what rights you have over it — is set out in the privacy policy.
Anything still unclear, or a mistake spotted on this page: hello@occlusia.app