Cookie Policy
Last updated 19 October 2026
This policy explains cookies and similar storage used by AxiOstra, their purposes and lifetimes, and the choices available on your device. It supplements the Privacy Policy.
1. Scope and responsibility
Cookies are small records sent with relevant web requests. Local storage, session storage and IndexedDB retain information in your browser and do not automatically send every stored value with every request. These technologies are covered here whether or not the stored information identifies you. The AxiOstra Operator identified on the About Us page is responsible for the uses described in this policy. Contact: [email protected].
Necessary storage supports a feature you request or a proportionate security function. Optional preferences are enabled by an affirmative current preference-storage choice. Consent requirements and lawful exceptions depend on applicable law; labelling a technology necessary does not itself establish an exemption.
2. Authentication and security cookies
axiom_session maintains sign-in for up to seven days. It is HttpOnly, uses SameSite=Lax and is Secure on the HTTPS production site. Signing out invalidates the corresponding session. axiom_google_oauth stores state and PKCE information for Google sign-in requested by you; its lifetime is ten minutes and it is cleared when the callback is processed. It uses the same cookie protections.
axiom_device is a random browser identifier used for account security and device management. It can be created during signed-out browsing, has a one-year cookie lifetime and uses SameSite=Lax. It is not an advertising identifier. The language is determined by the URL: Chinese pages use /zh and English pages use the unprefixed route. A legacy axiom_locale cookie is removed by current routing.
3. Requested features and technical storage
axiom-consent in local storage records your choice and the consent version, without a fixed automatic expiry. The axiostra-dm IndexedDB database stores an unlocked messaging key when you use encrypted messaging. The key is marked non-exportable, but scripts permitted to run on the page may still use it for cryptographic operations. The application sign-out flow removes its retained messaging key. Clearing site data can remove keys needed to read messages.
Local writing recovery uses keys beginning axiostra:writer:v2: followed by the account and draft identifiers. Publishing removes the relevant draft; otherwise there is no fixed automatic expiry. Session-storage keys axiom-chunk-reload and axiom-slow-notice prevent repeated update reloads and repeated model-performance notices. They normally last for the tab session, subject to the browser’s session-restoration behaviour.
4. Optional preferences
Website preference keys include axiom-theme (theme), axiom-keys (laboratory controls), axiom-view (views), axiom-dm-emoji (recent emoji), and axiom-learning-v1: (local quiz completion). The app also uses axiostra-learning-v2: keys for separate guest and account course records and pending synchronization. Guest records join an account only on request. The app does not import browser profiles. Local records have no fixed expiry and remain until removed or app/browser data is cleared. Clearing local data does not delete records already synchronized to the server; account deletion removes those server records.
The application does not currently integrate advertising or audience-analytics scripts. Optional preferences are not a condition of access to the core service. Some settings saved with an account are server-side account records, not cookies; the Privacy Policy explains those records.
5. Choices, withdrawal and shared devices
Use Cookie Settings in the footer to reopen the controls. Reject All and Necessary Only both remove the listed optional preferences and prevent new optional reads and writes. Save Selection applies the optional-preference choice shown in the expanded controls. Necessary records remain available for their stated functions. Changing a choice does not retrospectively invalidate processing that was lawful when performed.
Browser controls can block or delete cookies and site storage. Doing so may sign you out, remove drafts, reset preferences or affect encrypted-message access. Save work and check message recovery options first. On a shared or school device, sign out after use and avoid leaving private drafts or unlocked messaging keys accessible to another person. Browser blocking and storage limits can affect whether a choice is remembered.
6. Service providers and changes
Hosting and network-security providers may process requests or use their own security technologies according to the actual deployed configuration. Google sign-in opens Google’s service when you choose it. AxiOstra’s preference controls do not control independent services reached through external links. The Privacy Policy identifies provider categories and international processing; the absence of an advertising script is not a promise that no provider ever processes request information.
Material changes to storage purposes will be disclosed, and a fresh choice will be sought where required. Questions about a browser record or an unexpected cookie may be sent to [email protected], with its name and the affected page, without including its secret value.