Cookie & Tracking Technologies Use Policy
This Cookie & Tracking Technologies Use Policy explains how Archonite ("we", "us", or "our") uses cookies and similar storage technologies when you use our API, dashboard, or client-side verification SDKs.
1. What are these technologies?
We use two primary types of local data storage to ensure the security and functionality of our platform:
- Cookies: Small text files stored on your device that allow our servers to recognize your session.
- Local & Session Storage: Browser-based storage mechanisms that allow us to persist your authentication state within 4-hours (e.g., keeping you logged in) before timeout without sending data to the server with every single request.
2. How We Use Them (The Categories)
Under the GDPR and ePrivacy Directive, we categorize our usage into Strictly Necessary and Functional. Archonite prioritizes a "minimalist" approach to tracking.
A. Strictly Necessary (Essential)
These technologies are fundamental to the operation of the Archonite platform. Without them, we cannot provide the services you have requested (such as logging in or verifying an identity). These do not require user consent.
| Name / Key | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
c_session | Cookie | Archonite | Session Management. Stores a cryptographically signed JWT containing your session identifier, IP address, and user-agent string to prevent session hijacking. | 4 Hours |
x-archonite-csrf | Header | Archonite | Security. A unique token managed in our database and passed via request headers to protect against Cross-Site Request Forgery (CSRF) attacks. | Short-lived (Single Use) |
sb-{id}-auth-token | Local Storage | Supabase | Dashboard Auth. Stores your active dashboard session token for secure communication with our backend persistence layer. | Persistent (until logout) |
__stripe_mid, __stripe_sid | Cookie / Script | Stripe | Fraud Prevention. Essential for payment security (Stripe Radar) to detect high-risk transactions and prevent card testing attacks. | 1 Year / 30 Mins |
B. Security & Fraud Detection (Operational)
Archonite utilizes specific digital signals to protect our users and infrastructure from automated attacks, account takeovers, and fraudulent verification attempts.
- Client IP Address: Collected to enforce rate limiting, prevent DDoS attacks, and verify geographic consistency during identity checks.
- User-Agent & Device Fingerprint: Analyzed (and sometimes salted/hashed) to detect emulators, identify bot traffic, and ensure that a session remains bound to the original device.
- Activity Logging: We record high-level actions (e.g., "login successful", "document uploaded") alongside session metadata to provide an audit trail for your security.
3. Third-Party Analytics & Scripts
Currently, Archonite does not utilize third-party tracking pixels (such as Meta Pixel) or invasive ad-tech cookies.
Archonite is committed to a clean, privacy-first experience. We have opted out of common third-party trackers to ensure your data remains within our secure perimeter.
- Vercel Analytics: We use server-side metrics to monitor the latency and error rates of our API endpoints. This process is handled externally to your browser and does not install any cookies or tracking scripts on your device.
Note: While we do not use marketing pixels, we do utilize Stripe.js for payment security. This script is strictly limited to tokenizing payment information and detecting fraud (e.g., bot prevention) during the checkout process used mainly by Polar.
4. Managing Your Preferences
Because Archonite primarily uses Strictly Necessary technologies for security and session integrity, disabling these in your browser will significantly degrade or break the application (e.g., you will be unable to maintain an active session).
However, you can control cookie behavior at the browser level:
- Google Chrome: Settings > Privacy and security > Cookies and other site data
- Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
- Safari: Preferences > Privacy
5. Updates to This Policy
We may update this policy periodically to reflect changes in our technical architecture or security controls. The "Last Update" date at the top of this document will always reflect the most recent version.
A comprehensive attestation of Archonite's security controls, architecture, and operational maturity, aligned with the MVSP standard for enterprise procurement.
A detailed registry of third-party data processors, infrastructure providers, and service partners utilized by Archonite, ensuring transparency and GDPR Article 28 compliance.