Legal
Cookie Policy
Version 1 · effective October 14, 2026
This is version 1, kept so that what someone accepted stays readable. Read the version in force.
Draft, pending counsel. This page is placeholder structure. Counsel writes the final text.
Placeholder structure for counsel. The list of cookies on this page is rendered from the code (src/lib/legal/cookies.ts), so it is always the list the app actually sets. Counsel writes the words around it in a new file, v2.md, without the marker line above.
What cookies are
Placeholder: counsel writes a short explanation of cookies.
Cookies OmniBio sets
Placeholder: counsel writes an introduction to the table below. Every cookie OmniBio sets is strictly necessary for a service the user asked for: signing in, staying signed in, or finishing a step they started.
Cookies set inside payment and domain flows
Placeholder: counsel writes that the payment gateway's card form and the domain set-up window, opened only when the user starts those flows, may set their own strictly necessary cookies.
Consent
Placeholder: counsel writes that OmniBio sets no analytics, advertising or tracking cookies, so no consent banner is shown. Adding any such cookie needs a consent design first.
Changes
Placeholder: counsel writes how this policy changes and how readers are told.
Every cookie OmniBio sets
All of them are strictly necessary for something you asked for. None is used for analytics, advertising or tracking, so there is no consent banner.
| Name | Purpose | Lifetime | Where |
|---|---|---|---|
| __Host-omni_session | Keeps you signed in. An opaque token; only its hash is stored.Strictly necessary · set by OmniBio | Until you sign out, or 7 days | Portal; a clinic's storefront domain |
| __Host-omni_signin | Ties a sign-in link to the browser that asked for it.Strictly necessary · set by OmniBio | 15 minutes | Portal |
| __Host-omni_confirm | Confirms that you pressed the sign-in button on the confirmation page.Strictly necessary · set by OmniBio | 2 minutes | Portal |
| __Host-omni_curated | Keeps a cart your clinic sent you through sign-in, so the link is not put in the address bar.Strictly necessary · set by OmniBio | 30 minutes | Portal |
| __Host-omni_smscart | Keeps an order you texted to OmniBio through sign-in, so the link is not put in the address bar.Strictly necessary · set by OmniBio | 30 minutes | Portal |
| __Host-omni_handoff | Protects the sign-in hand-off between the portal and your clinic's own domain.Strictly necessary · set by OmniBio | 10 minutes | A clinic's storefront domain |
| __Secure-authjs.callback-url | Remembers where to return after a sign-in link is requested.Strictly necessary · set by Auth.js (configured by OmniBio) | Until the browser closes | Portal |
| __Host-authjs.csrf-token | Protects the sign-in link's callback against cross-site requests.Strictly necessary · set by Auth.js (configured by OmniBio) | Until the browser closes | Portal |
| omni_gate | Remembers the shared demo password, so the demo gate is not shown on every page.Strictly necessary · set by OmniBio · never set in production | 7 days | Portal (demo and staging only) |
On a local development server the names drop the __Host- and __Secure- prefixes, which need HTTPS.