Cookies and browser storage policy
Shared-service authentication, security, consent records, preferences, optional measurement, and browser controls across Solarius.
Last revised: October 23, 2026
This Cookies and Browser Storage Policy ("Policy") sets out the purposes, limits, and choices applicable to browser storage used by Solarius B.V. ("Solarius") for common account, identity, business administration, and public web services. It supplements the Privacy Policy. Product-specific schedules govern additional application state within their scope; a listed identifier is not a representation that every product installs it. Requirements for access to terminal equipment apply separately from the lawful basis for processing any resulting personal information.
Scope and purposes
Cookies are browser records sent to the relevant service according to their scope. Local storage remains within the browser's origin and can persist across sessions; session storage applies to the relevant tab or restored browsing session. Equivalent technologies remain subject to the same purpose and consent requirements. The use of a first-party identifier or an alternative technical mechanism shall not establish strict necessity, anonymization, or an exemption from consent. Where one mechanism serves multiple purposes, each purpose requiring consent shall remain inactive until valid consent for that purpose has been obtained.
Shared identity and administration state is limited to authentication, request protection, recorded privacy choices, and requested preferences. A remembered organization identifier is not proof of continuing membership. Access must remain subject to server-side authorization and revocation. Independent hosts do not receive a universal session merely because they use Solarius branding.
Necessary shared-service state
Shared identity and administration services use these identifiers for the stated purposes:
| Identifier | Purpose | Maximum lifetime | Restrictions |
|---|---|---|---|
__Host-solarius_identity | Opaque authenticated identity-session reference | 8 hours after issue or authorized renewal, subject to a shorter configured policy | Secure, HttpOnly, SameSite=Lax, host-only, Path=/ |
__Host-solarius_console | Opaque administration-session reference for the signed-in account | 8 hours after issue or authorized renewal, subject to a shorter configured policy | Secure, HttpOnly, SameSite=Lax, host-only, Path=/; organization access rechecked |
__Host-solarius_csrf | Random anti-forgery value for the relevant browser session | Session; invalidated on sign-out or expiry | Secure, SameSite=Lax, host-only, Path=/; limited to request validation |
__Host-solarius_auth_state | State and nonce for a user-initiated authentication callback | 10 minutes; consumed or invalidated when the flow ends | Secure, HttpOnly, SameSite=Lax, host-only, Path=/ |
solarius_privacy_choice | Optional-processing choices, timestamp, and notice version | 12 months, unless replaced or cleared earlier | First-party, Secure, SameSite=Lax; used to apply and demonstrate the choice |
Each stated lifetime is an upper limit, subject to earlier revocation, security action, inactivity limits, or a shorter applicable organization policy. Optional identifiers shall not be silently refreshed or replaced to circumvent that upper limit. Authentication or a user's renewed choice can commence a new corresponding period. A security identifier shall not be repurposed for optional analytics, advertising, or unrelated cross-service profiling.
Requested preferences and optional measurement
Requested preferences and optional measurement have separate storage limits:
| Identifier | Mechanism and purpose | Maximum retention and condition |
|---|---|---|
solarius_locale | Cookie recording a selected language and regional format | 12 months after the selection |
solarius.appearance | Local storage recording a selected appearance | 12 months after the selection |
solarius.last_organization | Local storage recording the last expressly selected organization identifier | 30 days; confers no authorization |
solarius_site_metrics | First-party cookie for optional interaction and performance measurement using a random browser identifier | 30 days; disabled by default and created only after opt-in |
Preference storage shall be limited to the selected function and shall require consent where the applicable law requires it. Application-managed local expiry shall remove or disregard a value after its stated period. No password, recovery code, customer content, payment credential, private key, or subscriber list shall be placed in preference or optional-measurement state.
Optional measurement is limited to service improvement and reliability for the relevant surface. It shall not follow a person across unrelated services, incorporate customer content, or be used for cross-context behavioral advertising. A random identifier remains personal information where a device or person can reasonably be singled out. Materially different purposes or recipients require additional notice and the applicable lawful choice before activation.
Consent and withdrawal
The relevant surface shall provide accessible Accept optional, Reject optional, and Manage preferences controls, without preselected optional categories or unequal barriers to refusal. Necessary sign-in functions shall remain available when optional measurement is rejected. The Cookie preferences control in the service footer shall permit reopening and withdrawal of optional choices as readily as they were given.
Optional consent shall be specific, informed, freely given, and demonstrated by an affirmative choice for the stated purpose. Continued browsing, acceptance of service terms, confirmation of an operational subscription, and browser push permission shall not constitute such consent. Solarius shall retain only the evidence necessary to demonstrate and honor the applicable choice. Withdrawal prevents further optional collection and invalidates the applicable identifier, subject to a limited lawful record necessary to honor the choice. Legally applicable universal opt-out signals shall be respected for the activities they cover.
Product schedules and external services
The Infra, Guard, and Status Cookie policies specify their application state. Their actual scope and shorter limits control the identifiers they describe. A consumer product or additional operated surface must disclose any distinct processing before activation rather than silently inheriting an unrelated business schedule.
An identity provider, payment destination, or customer-selected embedded service can set state under its own origin and privacy terms. Solarius shall not use that relationship to infer consent to unrelated tracking. External content requiring consent must remain inactive until the applicable permission is obtained. A customer's independent self-hosted modifications, proxies, and plugins require that operator's own accurate inventory and notice.
Browser controls and inquiries
A browser can inspect, restrict, or remove cookies and site data and revoke notification permissions. Removing necessary state can end a session or reset a choice. It does not revoke every remote session, erase server-side records, close an organization, or cancel renewal. Those actions require the relevant verified process.
Report an unfamiliar identifier to help@solarius.me with its name, domain, and observation time, excluding the value. Personal-data inquiries use dpo@solarius.me. Material changes to purposes, recipients, or mechanisms shall be disclosed before activation, with renewed consent where required. A policy edit does not retroactively validate collection.