Cookie Policy

Last updated: April 30, 2026

This Cookie Policy describes the cookies and local-storage entries Alma uses on alma.olivares.ai. It complements our Privacy Policy and is provided for transparency under the EU ePrivacy Directive (2002/58/EC) and the GDPR.

1. Summary

• No tracking cookies. No analytics, advertising, retargeting or third-party trackers are loaded on any Alma surface.
• No third-party cookies. Marketing pages, the app, and the docs do not embed third-party scripts that set cookies in your browser.
• Strictly necessary only. The single cookie we set is required to keep you logged in. Without it, the service cannot function.
• Informative notice, not a consent banner. EU ePrivacy law (Directive 2002/58/EC, Art. 5(3)) exempts strictly-necessary cookies from prior consent. We show a one-time discreet notice on first visit so you know what we set — there is no Accept/Reject choice because there is no non-essential cookie to decline.

2. Cookies we set

alma_session — authenticated session JWT that keeps you logged in. HttpOnly, Secure, SameSite=Strict. Cannot be read by JavaScript. Duration: 7 days, rotates on activity. Type: strictly necessary.

3. Browser local storage

We also use the browser's localStorage for non-essential UI preferences. These entries live entirely on your device, are not transmitted to our servers, and are not used for tracking: alma_language (selected interface language), alma_theme (light or dark theme preference), alma_has_session (boolean hint that lets the SPA skip a network round-trip when the cookie is present), alma_dismissed_* (one-time UI hints you have dismissed). You can clear these entries at any time from your browser's site-settings panel; doing so resets your UI preferences but does not log you out (the auth cookie is separate).

4. Third-party cookies

We do not embed third-party tracking pixels, advertising tags, or analytics scripts on any Alma surface. The only third-party network calls Alma makes from the browser are: Cloudflare Turnstile on the registration form (a privacy-friendly CAPTCHA, transient cookie scoped to challenges.cloudflare.com); and Polar checkout when you start a paid purchase (loaded in an iframe or a redirect on its own domain polar.sh). Cookies set by Polar belong to Polar's domain and are governed by Polar's privacy policy. Polar uses Stripe as its underlying card-network provider; any Stripe-set cookies are scoped to Stripe's domain and only present during the Polar checkout flow.

5. Your choices

• Block all cookies in your browser: Alma will not be usable — the auth cookie is required to log in.
• Block third-party cookies: Alma works fully; only the checkout flow may behave unexpectedly.
• Clear localStorage: resets language/theme/UI hints; auth cookie unaffected.
• Delete account: clears all server-side data and invalidates active sessions.

6. Updates

If we ever introduce a non-essential cookie (e.g. analytics), this page will be updated and a consent banner will be shown before the cookie is set, in line with the EU ePrivacy Directive. We will not retroactively activate any non-essential cookie without explicit opt-in consent.

7. Contact

Questions about cookies or this policy: privacy@olivares.ai.

See plans