Cookies & browser storage
Ovok uses a small amount of first-party storage to keep requested sign-in and console features working. Optional console preferences and optional product analytics are used only when you allow them.
What we use
Essential storage is limited to functions you request, such as signing in or completing an MCP authorization. It is not used for advertising or cross-site tracking. Product analytics (PostHog) is opt-in: until you turn it on, PostHog captures nothing and stores nothing in your browser. Ovok does not use advertising cookies.
| Category | Storage | Purpose | Duration |
|---|---|---|---|
| Essential | ovok-access, ovok-expiry, and ovok-refresh | Keep your signed-in console session working. Access and refresh tokens are HttpOnly and first-party. They are scoped to /api/session and use SameSite Strict. Secure is set in production. | Access and expiry cookies follow the issued access-token lifetime. The refresh cookie is session-only. |
| Essential | ovok-mcp-[environment]-* | Keep an MCP sign-in for the selected environment working. Depending on the session, these can contain an access token, its expiry, and the signed-in email. They are HttpOnly and scoped to /api/session/mcp, use SameSite Strict, and are Secure in production. | Until the issued MCP access token expires. |
| Essential | ovok-mcp-return-to | Temporary session storage keeps the return path so sign-in can continue the MCP connection you started. | Until the handoff is read or the browser tab closes. |
| Essential | ovok-privacy-choice | A first-party cookie records your storage choice so Ovok can honor and remember it. It is host-only, uses SameSite Lax, and is Secure in production. | 180 days, then we ask again. |
| Optional preference | Console preferences (optional) | Browser local storage remembers that the project setup checklist is complete, and caches console data (your account and plan, project settings, environment status, email provider status and the CMS schema) so pages open without waiting. It never holds FHIR resources, patient, device or Signals data, request details, CMS documents, email templates or application secrets. | Cached console data expires after 24 hours and is removed when you sign out or switch environment or project. All of it is removed when permission is withdrawn or expires, or when you clear browser storage. |
| Optional analytics | ph_* and __ph_opt_in_out_* (PostHog) | If you allow product analytics, a first-party cookie and local storage hold a random anonymous id and session id so PostHog can count visits. Page views, clicks, browser and device type, referrer and approximate location from your IP address are sent to PostHog through Ovok’s proxy at proxy-production-abe6.up.railway.app. Before sending, page text and element attributes are masked, query strings and URL fragments are removed, password-setup links are redacted, and FHIR record ids in console URLs are replaced with :id. There is no session recording, and we do not send your name or email. | The cookie lasts up to 365 days (PostHog’s default); events are kept for PostHog’s default retention period for our plan. We remove the browser storage when you withdraw permission or your choice expires. |
Your choices
You can keep essential storage only, allow Ovok to remember the optional setup preference, allow product analytics, or both. Both are off until you choose them. You can change this at any time using Cookie settings in the website footer or the console account menu. Turning the preference off removes its saved completion markers and cached console data from this browser. Turning analytics off stops PostHog capturing immediately and removes its cookie and local storage from this browser.
Essential sign-in and security storage remains active because it is needed to provide the service you request. Your browser also lets you clear or block storage; blocking essential storage may prevent sign-in and related features from working.
Last reviewed . Ovok’s storage inventory should be updated whenever the site adds a cookie, analytics tool, or third-party embed.