Trust
Cookies and Local Storage
Arihna Biha uses cookies, localStorage, and sessionStorage for access, security, OAuth, preferences, and short interface handoffs.
Last updated: October 1, 2026
Cookies
Cookies are sent with relevant web requests and have verified maximum lifetimes.
Access and security
- arihna_access_session: private access gate when used; up to 12 hours
- arihna_auth_session: signed-in session; up to 7 days for users and 2 days for administrators
- arihna_csrf_token: protects state-changing requests; up to 7 days
- OAuth transaction cookies: protect sign-in and calendar callbacks; up to 10 minutes and cleared after the callback
Preferences and handoff
- arihna_language_preference and arihna_theme_preference: route language and display choice; up to 1 year
- Help Center language handoff cookies: preserve section and scroll position; up to 60 seconds
- ab_workspace_hidden_agenda_sources: hidden Agenda-source choices; up to 1 year and limited to /workspace
Local storage
localStorage remains in the browser until the app replaces it or the user clears site data.
Saved preferences
- Language and theme preferences
- Agenda source color overrides and hidden Agenda-source identifiers
Short handoffs
- OAuth popup completion results, removed when the originating page reads or cleans them up
- These entries have no fixed browser expiry; clearing site data removes them
Session storage
sessionStorage is limited to the current browser tab and is cleared when that tab session ends.
- OAuth launch and back-navigation protection
- Onboarding resume and completion handoffs
- A temporary incident receipt used to prefill a user-selected problem report
External services and consent
Browser storage is assessed by purpose; no blanket consent exemption is claimed.
Current use
Arihna Biha uses the items above for requested preferences, authentication, security, OAuth, and interface continuity. Cloudflare Turnstile is enabled on sensitive flows. Production does not currently enable advertising, retargeting, non-essential analytics, session replay, or Sentry browser monitoring.
What is not a cookie
Stripe Checkout and billing-portal returns use URL query parameters, not a billing-return cookie. Stripe, Google, Microsoft, Cloudflare, and other external services can process requests under their own notices when the user chooses the related feature.
If optional analytics, advertising, session replay, or another non-essential technology is introduced, Arihna Biha will reassess the storage, update this page, and request consent before use where the law requires it.