Cookie Policy

Cookies are small values a site asks a browser to retain. Browser storage can keep limited preferences on the device. Oikivo does not currently enable non-essential advertising or marketing cookies by default.

Descriptive name: contractor session cookie. Purpose: authenticate the service-business account. HttpOnly: yes. Secure: required in production. SameSite: Lax. Path: /. Approximate expiry: 30 days, subject to server-side revocation.

Descriptive name: owner session cookie. Purpose: authenticate access to the property workspace. HttpOnly: yes. Secure: required in production. SameSite: Lax. Path: /. Approximate expiry: 30 days, subject to server-side revocation.

A CSRF cookie and matching request header protect authenticated changes from cross-site request forgery. The token is not an authentication credential.

Oikivo may retain the chosen EN or SK locale in browser storage so the interface remains in the selected language.

When a user chooses Google sign-in, Google Identity may use its own browser technologies under Google’s policies. Oikivo does not invoke Google authentication for users who do not choose it.

Server logs may record safe request metadata, status, duration and a request ID. Operational logs are not browser cookies and do not contain session-cookie values.

Non-essential analytics, advertising and third-party media are not enabled by default. If introduced, they require a separate assessment and any legally required consent controls.

Browser settings can remove or block cookies. Blocking essential session or CSRF cookies prevents sign-in and authenticated changes. Signing out revokes the server session and expires the relevant session cookie.

Use the configured support or privacy contact for questions about these technologies.