Cookie Policy

Cookies are small values a site asks a browser to retain. Browser storage can keep limited preferences on the device. Oikivo does not currently enable non-essential advertising or marketing cookies by default.

Descriptive name: contractor session cookie. Purpose: authenticate the service-business account. HttpOnly: yes. Secure: required in production. SameSite: Lax. Path: /. Approximate expiry: 30 days, subject to server-side revocation.

Descriptive name: owner session cookie. Purpose: authenticate access to the property workspace. HttpOnly: yes. Secure: required in production. SameSite: Lax. Path: /. Approximate expiry: 30 days, subject to server-side revocation.

A CSRF cookie and matching request header protect authenticated changes from cross-site request forgery. The token is not an authentication credential.

Oikivo may retain the chosen EN or SK locale in browser storage so the interface remains in the selected language.

When a user chooses Google sign-in, Google Identity may use its own browser technologies under Google’s policies. Oikivo does not invoke Google authentication for users who do not choose it.

Server logs may record safe request metadata, status, duration and a request ID. Operational logs are not browser cookies and do not contain session-cookie values.

With your consent, Oikivo uses PostHog Cloud EU for privacy-conscious page views and a small set of explicit product events. Session Replay, heatmaps, surveys, form autocapture and advertising tracking are disabled. Analytics are off until you accept them.

Use the analytics preferences on this page to accept or withdraw analytics consent at any time. Declining analytics does not affect Oikivo functionality. Browser settings can remove or block cookies, but blocking essential session or CSRF cookies prevents sign-in and authenticated changes.

Use the configured support or privacy contact for questions about these technologies.