Cookie policy

1. Sign-in, device and consent cookies

First-party account_access lasts up to one hour and authenticates requests. account_refresh lasts for the session: normally 30 days, or up to one year with “remember me”. Sessions also end after 60 days of inactivity or when revoked. These cookies support sign-in and session security.

First-party account_device lasts up to 400 days. It contains a random device identifier; the server keeps its hash. It links actions to a device and helps manage sessions and investigate misuse. It may also be used for referral activity after you consent to referral tracking.

First-party privacy_choice remembers your separate analytics and referral choices for up to 180 days, including a refusal. It is necessary to respect those choices. Without a valid saved choice, both optional categories remain off.

2. Language, appearance and saved places

First-party site_locale remembers the language for up to one year in a cookie and also in localStorage. opthai_theme in localStorage remembers the appearance. In the cabinet, first-party account_zones_off remembers the districts of the map switched off and opthai_split the width of the map beside the list of places; both cookies last up to one year. Local storage has no automatic browser expiry and normally remains until cleared or replaced.

Favourites are stored with your account. Older opthai_favorites browser records, if present, are imported into the account and removed from localStorage. Technical sessionStorage may also prevent repeated page reloads; it normally lasts for the browser tab's session.

3. Referral attribution

Referral clicks are recorded and first-party partner_code is saved only after you consent to referral tracking. It records the partner whose link you followed and helps fill in a promotional code and attribute a purchase. The cookie lasts 30 days. A localStorage copy stores the code and timestamp and, while consent remains valid, can restore the cookie for the remaining attribution period.

Refusing or withdrawing referral consent clears partner_code from cookies and localStorage and prevents its restoration without new consent. Manually entering a promotional code remains available. Browser deletion or withdrawal does not erase a referral or transaction already recorded on the server; you can make a separate data request.

4. Analytics and external resources

If Google Analytics or Google Tag Manager is configured, its resources load only after you allow analytics in cookie settings. Analytics may use identifiers such as _ga and _ga_* to measure visits and interactions; the exact cookies and duration depend on the enabled tags and their configuration. Google Tag Manager may load additional configured tags after that consent. Withdrawing analytics consent prevents further loading of these resources; it does not erase information already sent.

Fonts, maps, place search and avatars also involve external requests as described in the privacy policy. A request can disclose connection information even without setting a cookie. The analytics and referral choices control the corresponding tracking; they do not switch off every external resource used by the service.

5. Your available controls

The cookie panel lets you keep only necessary storage, accept both optional categories or choose analytics and referral tracking separately. You can reopen it with the cookie settings button and change or withdraw consent at any time. Your choice applies to the current browser; use the settings again on another browser or device.

Browser settings also let you inspect, block or clear cookies and site storage. Blocking sign-in cookies can prevent account access; clearing preferences resets choices. After the consent cookie is removed, reloading the page turns optional tracking off until a new choice is saved. Browser controls cannot reverse disclosures already made.

For questions, objections or requests concerning data already processed, write to d@opthai.land. Your rights under applicable law remain available regardless of browser settings. Details of server-side processing and requests appear in the privacy policy.