Cookies and local storage
Short version: the marketing site sets no cookies of its own, does no advertising and no cross-site tracking. The app stores what it needs to keep you signed in and to remember a few choices. Nothing here is sold, shared or used to build a profile.
1. Marketing site (hourino.com)
Pages are static. Nothing is written to your browser unless you allow analytics — and then it is one entry recording that choice.
| Name | Where | What for | How long |
|---|---|---|---|
hourino.analyticsConsent |
local storage | Remembers whether you allowed or declined analytics, so we stop asking. | Until you clear it (see section 4) |
2. Analytics
We want to know which pages help people find Hourino. That is a legitimate thing to measure and a terrible reason to install advertising trackers, so the plan is deliberately small: page views and clicks on a handful of buttons, no cookies, no cross-site identifiers, no profiles, and the data stays in the EU.
When analytics is switched on with a tool that stores nothing in your browser, there is nothing to consent to and you will not see a banner. If we ever switch to a tool that does store something, the banner appears and nothing loads before you decide — that is enforced in code, not by policy: the provider's script is injected only after you allow it.
Declining means no analytics script is loaded at all and no events are sent. We do not buffer them for later.
Whatever we run is listed on the sub-processors page, with who they are and where they keep data.
3. The app (app.hourino.com)
The app keeps its state in local storage rather than cookies, so it travels with the tab and never rides along with requests to other sites. None of it is used for tracking; the first two cannot be switched off without breaking sign-in.
| Name | Where | What for |
|---|---|---|
hourino.accessToken, hourino.refreshToken |
local storage | Keeps you signed in. Without it you would be logged out on every page load. |
hourino_lang |
cookie | The language you picked, so the server sends you to the right one next time. Read by our own server only. |
hourino.locale |
local storage | The same choice, kept for the desktop app, which has no server to ask. |
hourino.activeWorkspaceId, hourino.timerVersion |
local storage | Which workspace you were last in, and a marker that makes other open tabs refresh a running timer. |
hourino.onboarding.dismissed.* |
local storage | That you closed the getting-started checklist, so it stays closed. |
hourino.pendingInvite |
local storage | An invitation you opened before signing in, so it still works after you log in. Removed once used. |
hourino.apiBaseUrl |
local storage | Desktop app only: which server to talk to. Useful for self-hosting. |
The desktop app additionally keeps your refresh token in the operating system's keychain — not in a file and not in the browser storage above.
4. Third parties on our pages
Two things can load from someone else's server, both only where they are needed: Cloudflare Turnstile on the sign-up form (to keep bots out) and Sentry for error reports. Neither is advertising and neither builds a profile of you; both are listed on the sub-processors page. What we deliberately keep out of error reports is described in the privacy policy.
5. Changing your mind
Your analytics choice right now: not decided yet. Ask me again clears the stored choice and reloads the page.
Everything else can be cleared in your browser's site-data settings. Clearing it signs you out of the app and forgets your preferences — nothing is lost on our side.