This policy lists every cookie OIDA sets, what each one is for, how long it lasts and how to change your mind. It is part of the privacy policy, which explains the rest of what we process and the rights you have.
1. The two categories
| Category | What it is for | Consent |
|---|---|---|
| Strictly necessary | Signing in, staying signed in, knowing which organisation is open, carrying an invitation through sign-up, and remembering the choice you make in the banner | Not required by law, and not asked. Without them the service cannot work. |
| Measurement | Recording how the public site and the sign-up pages are used, with PostHog: pages viewed, clicks and a replay of the navigation with every field you fill in masked, so we know which pages and which campaigns bring organisations to OIDA | Off until you switch it on. You can withdraw at any time. |
There is no third category. OIDA has no advertising, no profiling, no audience segments and no cookies that follow you to other sites.
2. Strictly necessary cookies
All of them are first-party cookies of this deployment, with SameSite=Lax and, in production, the Secure flag. The application’s cookies are signed and cannot be read by scripts in your browser. oida_consent is written by the banner itself, which is how a page knows whether it still has to ask you. None of them measures anything.
| Cookie | Purpose | Lifetime | Set on |
|---|---|---|---|
oida_session | Keeps you signed in to the web application. Signed, and not readable by scripts. | Session, renewed while you use the application | Application |
oida_org | Remembers which of your organisations is open | Session | Application |
oida_next | Returns you to the page you asked for after sign-in | Minutes | Application |
oida_invite | Carries an invitation through sign-up or sign-in | Minutes | Application |
oida_org_name | Carries the organisation name chosen at sign-up through email confirmation | Minutes | Application |
oida_preview | Opens the site behind the holding page for whoever has the preview link | 30 days | Site and application |
oida_consent | Records the choice you make in the cookie banner, so we do not ask again | 180 days | Marketing site, readable by the application |
3. Measurement, only with your consent
When you switch measurement on, the pages of the public site and the sign-up pages load PostHog’s script from this same domain, and from then on PostHog records the visit. Nothing is loaded and nothing is sent before you agree. The application itself is never measured: no page behind sign-in loads the script, and the banner does not appear there.
| Cookie | Purpose | Lifetime | Set on |
|---|---|---|---|
ph_<token>_posthog | Written by PostHog when you switch measurement on. Holds a random identifier and the identifier of the current session, so that the pages you open in one visit form one replay and a returning visit counts as the same browser. It says nothing about you, is not linked to your account, and means nothing outside this site. | 180 days | Marketing site and sign-up pages, on the domain the two share |
What a measured visit records:
| Recorded | Example |
|---|---|
| Page and time | /consulenza, 14 September 2026, 14:32 |
| Clicks: the element, its text and position | button “Start using OIDA” |
| A replay of the navigation: what the page showed, scrolling, mouse movement and clicks | every field you fill in shows as asterisks |
| Campaign parameters in the URL | utm_source=linkedin, utm_campaign=pilota |
| Landing variant, when a campaign uses one | v=b |
| Referring site | linkedin.com |
| Browser, operating system and screen size | Chrome, macOS, 1440 × 900 |
| Country, derived from your IP address, which is then discarded | Italy |
What is masked or left out: everything you type in any field, on every page, is replaced by asterisks before it leaves your browser. The email address printed on the page that follows a sign-up is hidden in the same way. The animated field of lines on the home page is drawn on a canvas, which the replay does not record. Your IP address reaches PostHog’s servers with every request, as it reaches any server, is used once to place the visit in a country, and is then discarded: it is not stored with the events or the replay. Nothing links a visit to your account, to your organisation or to anything held in a workspace.
Where it goes: PostHog Cloud EU, on servers in Frankfurt, Germany, operated by PostHog Inc. under a data processing agreement. In your browser the script and the events pass only through this domain, never through posthog.com. Replays are deleted after 30 days. PostHog’s own privacy policy is at posthog.com/privacy.
4. Similar technologies
Two kinds of browser storage are used besides cookies. They are not cookies, and the browser never sends them to a server on its own.
| Key | Kind | Category | Purpose | Lifetime |
|---|---|---|---|---|
ph_<token>_posthog | Session storage | Measurement | PostHog’s working memory for the open tab: the window identifier, whether this is the main window, and the session properties, such as the landing variant of a campaign | Until the tab is closed |
ph_<token>_window_id | Session storage | Measurement | PostHog’s working memory for the open tab: the window identifier, whether this is the main window, and the session properties, such as the landing variant of a campaign | Until the tab is closed |
ph_<token>_primary_window_exists | Session storage | Measurement | PostHog’s working memory for the open tab: the window identifier, whether this is the main window, and the session properties, such as the landing variant of a campaign | Until the tab is closed |
ph_<token>_session_registered_properties | Session storage | Measurement | PostHog’s working memory for the open tab: the window identifier, whether this is the main window, and the session properties, such as the landing variant of a campaign | Until the tab is closed |
__ph_opt_in_out_<token> | Local storage | Strictly necessary | Written when you withdraw measurement. Remembers the refusal, so PostHog sends nothing even if its script loads. Like the consent cookie, it records a choice rather than measuring anything. | Until you clear your browser storage |
oida-sidebar-collapsed | Local storage | Strictly necessary | Remembers whether the navigation rail of the application is collapsed | Until you clear your browser storage |
There are no tracking pixels, no web beacons and no fingerprinting. Fonts, images and scripts are served from this site only, PostHog’s script included: the content security policy of every page allows nothing else, so a tracker on another domain could not run here even if one were added by mistake.
5. Third parties
PostHog is the one third party that stores anything in your browser, and it does so only after your consent, from our own domain rather than from posthog.com. Two more providers appear elsewhere in the flow: Stripe, on its own checkout pages and under its own cookie policy, while paid plans are offered, and the authentication provider, which OIDA calls from its own servers, so it never reaches your browser. The full list of providers is in the privacy policy.
6. Giving, changing and withdrawing your consent
- The banner appears on your first visit. Accepting and refusing take the same single click.
- To change your mind later, use Cookie preferences at the foot of any page, or the button below.
- Withdrawing stops PostHog at once, deletes
ph_<token>_posthogfrom your browser and leaves the note in local storage that keeps it off. Replays already stored are deleted after 30 days. Write to us and we will delete them, and the events, sooner. - We ask again after 180 days, and whenever a new category or a new purpose appears. On 14 September 2026 measurement changed from a page counter of our own to PostHog, and everyone was asked again.
- Your browser can block or delete cookies as well. Blocking the strictly necessary ones stops sign-in from working.
7. Changes and contact
When this policy changes, the date at the top changes with it, and a new category is never switched on without asking. For any question about cookies or personal data, write to carlo@projectoida.com.