OrbitSub Legal & Trust Center
Cookie & Local Storage Policy
Complete technical inventory of every HTTP cookie, localStorage key, sessionStorage key, and browser API used by OrbitSub — with zero third-party ad trackers.
This Cookie & Local Storage Policy explains what cookies and browser storage mechanisms OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we", "us", or "our") uses when you visit orbitsub.com or use the Service, why each item exists, how long it lasts, and how you can inspect, control, or clear it.
This Policy supplements our Privacy Policy and is drafted in compliance with the Indian Digital Personal Data Protection Act, 2023, the EU ePrivacy Directive (Directive 2002/58/EC as amended) and GDPR, the UK Privacy and Electronic Communications Regulations ("PECR"), and US state privacy laws.
1. Zero Third-Party Advertising or Cross-Site Tracking Cookies
OrbitSub does not use any third-party advertising, retargeting, behavioural profiling, or cross-site tracking cookies or pixels. We do not embed Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, Mixpanel, or any third-party ad-tech scripts on our pages.
Because every cookie and browser storage entry we set on routine page loads is strictly necessary to authenticate your session, protect against cross-site request forgery, remember your explicit interface preferences, cache academic citation style definitions you select, or support first-party operational diagnostics (which you can opt out of at any time in Settings → Privacy), we display a clean, non-intrusive informational cookie notice rather than a manipulative "dark-pattern" ad-consent wall.
2. Complete Inventory of First-Party HTTP Cookies
When you sign in to OrbitSub, our backend server sets a single strictly necessary HTTP authentication cookie:
| Cookie Name | Type & Scope | Purpose | Security Attributes | Duration / Expiry |
|---|---|---|---|---|
refreshToken | First-party HTTP cookie (Path=/api/auth) | Keeps you signed in across page reloads and browser restarts by issuing short-lived in-memory access tokens. Rotated on every refresh; if a rotated token is ever replayed, the entire token family is revoked immediately. | HttpOnly; Secure (in production); SameSite=Lax (or None with Secure across configured origins) | 30 days from sign-in or last rotation (deleted immediately when you click Sign out) |
Why access tokens are never stored in cookies or localStorage
To protect your Account against cross-site scripting (XSS) token theft, your short-lived JSON Web Token (JWT access token) is held exclusively in volatile JavaScript memory (accessToken in src/lib/api.ts) and is never written to document.cookie, localStorage, or sessionStorage. Across multiple open tabs, OrbitSub uses the standard browser Web Locks API (navigator.locks.request('orbitsub-session-refresh')) so tabs take turns rotating the refreshToken cookie cleanly without race conditions.
3. Complete Inventory of Browser localStorage Keys
We use your browser's window.localStorage solely to remember explicit interface choices you make on your device and to cache open-access Citation Style Language (.csl) XML definitions so bibliographies format instantaneously offline:
| Storage Key | Category | Exact Purpose | Value Stored | Expiry / Retention |
|---|---|---|---|---|
orbit-cookie-notice-v1 | Strictly Necessary / Preference | Remembers that you dismissed the informational cookie banner so it does not reappear on every page load. | "1" | Persistent until you clear site data |
orbit-theme | Functional Preference | Remembers your chosen visual appearance mode so pages render without a light/dark flash on load. | "light", "dark", or "system" | Persistent until changed in the theme toggle or cleared |
orbit-walkthrough-v1 | Functional Preference | Remembers whether you have completed the interactive newcomer product walkthrough so it does not auto-open repeatedly. | "done" | Persistent until cleared |
orbit-nudge-dismissed | Functional Preference | Remembers if you dismissed the "Finish your profile" onboarding reminder card on the feed. | "1" | Persistent until cleared |
orbit-announcement-dismissed | Functional Preference | Stores a short numeric hash of a site-wide announcement banner you dismissed so that specific banner stays hidden while future announcements still appear. | Short numeric hash string | Persistent until a new announcement is posted or cleared |
orbit-emoji-recent | Functional Preference | Remembers the emojis you recently picked in the comment/message emoji picker on your device. | JSON array of up to 24 emoji characters | Persistent on your device until cleared |
orbit-emoji-tone | Functional Preference | Remembers your preferred emoji skin-tone modifier in the emoji picker. | Integer index (0 to 5) | Persistent on your device until cleared |
orbit-csl-style:<styleId> | Performance Cache | Caches long-tail Citation Style Language (.csl) XML files fetched from the official CSL registry so your paper bibliography renders immediately without redundant network requests. | Official CSL XML stylesheet text | Persistent cache until cleared |
4. Complete Inventory of Browser sessionStorage & In-Memory Diagnostic State
| Key / Mechanism | Storage Location | Exact Purpose | Value Stored | Retention & Opt-Out |
|---|---|---|---|---|
orbit_b_sid | window.sessionStorage | Generates a random, tab-scoped identifier (bs_<timestamp>_<random>) used to group first-party product diagnostic events (such as dead clicks, rage clicks, or page errors) within a single browser tab session. | Random session string (no personal identifiers) | Cleared automatically as soon as you close the browser tab. Completely disabled when you opt out of diagnostics in Settings → Privacy. |
recentRefIds | Volatile JavaScript memory only (never written to disk) | Keeps up to the last 10 request correlation IDs (ORB-YYYYMMDD-XXXXXX) received during your current page view so if you encounter an error, you can quote the Reference ID to Support. | Up to 10 ORB-YYYYMMDD-XXXXXX strings | Cleared immediately on page reload or tab close. |
5. Third-Party Cookies Triggered Only at Your Explicit Request
On normal visits and while writing research, no third-party cookies are set. Third-party services may set their own security, fraud-prevention, or session cookies only when you actively invoke that integration:
- Google Sign-In (
accounts.google.com): When you click "Continue with Google" on the Sign-In or Sign-Up page, Google's OAuth 2.0 flow runs under Google's own cookie and privacy policies to authenticate your Google account. - PayPal Checkout (
paypal.com): When you click to subscribe to a Pro or Max plan on our Pricing page or in Settings → Billing, you are redirected to PayPal's hosted checkout page, where PayPal uses its own session and anti-fraud cookies under the PayPal Privacy Statement. - Zotero, Mendeley & Overleaf: When you explicitly click to connect Zotero or Mendeley in your Library, or click "Open in Overleaf" to export a LaTeX archive to Overleaf, you interact directly with those providers' domains under their respective policies.
6. How to Manage, Inspect, or Clear Cookies and Local Storage
- Signing out: Clicking Sign out in the OrbitSub navigation menu immediately invalidates your session on our server and clears the
refreshTokencookie. - Opting out of first-party product telemetry: Open Settings → Privacy → Diagnostics & product analytics and toggle off "Share first-party product usage diagnostics". This immediately halts all first-party behaviour event batching for your Account.
- Browser controls: Every modern browser (Chrome, Edge, Firefox, Safari, Brave, Arc) allows you to inspect and delete cookies,
localStorage, andsessionStoragevia Developer Tools → Application → Storage or your browser's Settings → Privacy & Security → Clear browsing data. Note that blocking strictly necessary first-party cookies (refreshToken) will prevent you from staying signed in across page reloads.
7. Contact Us
Questions about this Cookie & Local Storage Policy may be sent to Karan (Founder & Grievance Officer, OrbitSub, New Delhi, India) at team@orbitsub.com (effective date: 1 October 2026; last updated: 25 October 2026).