Cookie Policy
Version 1.1 · Effective 2026-10-08 · Last updated 2026-09-24 · Operator: Auren LLC
1. The short version
CROSSPAD, a product operated by Auren LLC, sets one cookie for customers: cp_session, which keeps you signed in after you verify your email address with a one-time code. It is strictly necessary for the service, so we do not ask for consent to set it. (A second cookie, cp_admin, exists only for Auren LLC's own staff console at /admin; it is never set on a customer's browser.)
We also measure how the site is used. That does not use a cookie — it stores a random identifier in your browser's local storage — but the law treats the two the same, so we ask before storing anything. A banner offers "No thanks" and "Allow" as the same button, nothing is pre-selected, ignoring it means no, and once you have answered, a small marker at the bottom left of every page shows your choice and lets you change it.
We set no advertising, retargeting, social-media or third-party cookies, and we use no third-party analytics service.
2. What a cookie is
A cookie is a small text file a website stores in your browser and reads back on later requests so it can recognize your session. "First-party" cookies are set by the site you are visiting; "third-party" cookies are set by another domain through that site.
3. The cookie we set
| Name | cp_session |
|---|---|
| Set by | crosspad.co (first-party) |
| Purpose | Keeps you signed in after email-code verification so you can reach your Account, Orders and Delivery Bundles without re-entering a code on every page |
| Type | Strictly necessary |
| Contents | A signed session identifier — no name, email or file data |
| Lifetime | 7 days from sign-in, or until you sign out |
| Attributes | httpOnly (not readable by page scripts), Secure (sent only over HTTPS), SameSite=Lax (not sent on most cross-site requests) |
| Consent | Not required. The cookie is exempt under Article 5(3) of the EU ePrivacy Directive and regulation 6(4) of the UK PECR because it is strictly necessary to provide a service you asked for — being signed in. The Account it links to is processed under our Privacy Policy on the basis of our contract with you |
If you delete or block this cookie you are signed out and must request a new one-time code. The service does not work without it.
4. Storage that is not a cookie
Some of the site uses your browser's local storage rather than a cookie. Here is everything it writes, which is the whole list and not a selection:
| Entry | What it is for | Consent |
|---|---|---|
| The board viewer's saved view | Remembers how far you had zoomed and panned a drawing, so it looks the same when you come back to it. It holds a view position and nothing else, is tied to the file you were looking at, and never leaves your browser | Not required — strictly necessary to a feature you asked for |
| A signed-in marker | A single 1 written when you sign in, so the public pages can offer "Dashboard" instead of "Sign in". Our marketing pages are pre-rendered and the sign-in cookie cannot be read by page scripts, so without it those pages could not tell. It is a label, never a permission: every protected page is checked on our servers | Not required — strictly necessary |
cp_analytics_consent and cp_visitor | Audience measurement — detailed below | cp_visitor requires consent; the record of your choice does not |
Audience measurement is the only one of these that is not strictly necessary, which is why it is the only one behind the banner. Local storage is not sent automatically with every request the way a cookie is, but it is still storage on your device, so Article 5(3) of the ePrivacy Directive and regulation 6(4) of the UK PECR apply to it in the same way — which is why it is behind the consent banner described in section 6.
| Name | cp_analytics_consent |
|---|---|
| Set by | crosspad.co (first-party, local storage) |
| Purpose | Remembers whether you allowed or refused measurement, so we neither measure against your wishes nor ask you again on every page |
| Type | Strictly necessary. It records a refusal as faithfully as an acceptance |
| Contents | granted or denied, and the date you chose |
| Lifetime | Until you change your choice or clear your browser storage |
| Consent | Not required, and deliberately so: asking permission to remember a refusal would defeat the refusal |
| Name | cp_visitor |
|---|---|
| Set by | crosspad.co (first-party, local storage) |
| Purpose | Tells a returning visit from a new one, so visit counts are not inflated |
| Type | Not strictly necessary — measurement only |
| Contents | A random identifier with no meaning outside our records, and the date it was created. It is sent to our server only as a one-way hash |
| Lifetime | 13 months, then discarded and re-created. Deleted immediately if you withdraw consent |
| If you are signed in | The measurement record is also linked to your Account, so we can tell whether a page is failing customers or visitors. The identifier above is not what does that — your session is — and this is stated here because this page is meant to be the complete account of what measurement involves |
| Consent | Required. It is not created until you press "Allow", and it is erased when you withdraw |
We set no advertising, retargeting or social-media cookie, and no third-party cookie on crosspad.co. We use no third-party analytics service: the measurement above is our own code writing to our own database. We do not use browser fingerprinting, device fingerprinting, or any technique that identifies you without storing something you can delete.
Our hosting provider keeps standard server and edge logs (IP address, request path, timestamp) for security and availability; those are described in the Privacy Policy, section 3, are not cookies, and are not part of measurement.
5. Stripe's checkout page
When you pay, you are redirected to Stripe's hosted checkout page at checkout.stripe.com. That page is operated by Stripe, Inc. and sets its own cookies for payment processing and fraud prevention, governed by Stripe's cookie policy (https://stripe.com/cookies-policy/legal) and privacy policy (https://stripe.com/privacy), not by this policy. When you return to crosspad.co, cp_session is the only cookie on our domain.
6. The commitment we made, and how we kept it
Version 1.0 of this policy committed us, before any non-essential storage could be set, to four things. Audience measurement is the first time that commitment applied. This is what each one means in the product today, so you can check it rather than take our word:
- Consent first. A banner asks before anything is stored.
cp_visitordoes not exist in your browser until you press "Allow" — not on page load, not while the banner is open, not if you ignore it. Nothing is sent to our server either: the code that would send it returns without acting while consent is absent. - Unchecked by default. Nothing is pre-selected, and ignoring the banner leaves measurement off. Silence is a refusal, not an acceptance. There is deliberately no close button: a banner that vanished on a dismissal would look like an answer while recording none.
- Refusing is as easy as accepting. "No thanks" and "Allow" are the same size, the same colour and the same button style, side by side. Neither is emphasised, and refusing takes exactly one press, like accepting.
- You can change your mind. Once you have answered, a small marker at the bottom left of every page shows which way you chose and re-opens the question. It is not in the footer: our product pages do not have one, and those are the pages measurement actually runs on, so a footer link would have left you able to consent inside the product and unable to withdraw there. Using it erases the identifier from your browser and re-opens the question — withdrawal deletes, it does not merely stop reading.
The same commitment stands for anything we add next: a new version number, a new effective date, and every name, purpose, lifetime and type listed in section 3 or 4 before it is switched on. Strictly necessary storage stays consent-free and is listed here so you can see exactly what it is.
7. How to control cookies in your browser
You can view, delete and block cookies in your browser settings:
- Chrome: Settings → Privacy and security → Third-party cookies / See all site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari (macOS): Settings → Privacy → Manage Website Data
- Safari (iOS): Settings → Safari → Advanced → Website Data
- Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
Blocking cp_session prevents you from staying signed in to CROSSPAD.
8. Changes to this policy
Each version has a version number, effective date and last-updated date. We update it whenever the cookies we set change. Adding any non-essential cookie is announced on the website and, for Account holders, by email at least 14 days before it takes effect.
9. Contact
Questions about cookies: privacy@orkoottrae.resend.app. Postal address: Auren LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States.
Related documents: Privacy Policy (/privacy) · Terms of Service (/terms) · Security, File Retention and Deletion Policy (/security).
SHA-256 65f80e7549beafedaa717e874824b74dab340998026895daa8d51f9342b93a72
Version 1.1, effective 2026-10-08. Prior versions available on request at legal@orkoottrae.resend.app.