Legal
Cookie Notice
Document details
Version: 1.0 (draft). Effective date: none — this draft is not yet in effect, and nothing in it is in force. Last updated: 12 August 2026. Responsible entity: [SPHEROMNI RESPONSIBLE ENTITY — TBD]. Governing law and jurisdiction: [PRIMARY JURISDICTION — TBD]. Contact: [PRIVACY CONTACT — TBD].
Change history:
- Version 1.0 — first draft, written at Milestone 19 from the cookie and browser-storage code as it stands. Not in effect.
The short version
Spheromni sets two cookies, both strictly necessary to sign you in and keep you signed in. There is no advertising cookie, no third-party analytics cookie, no tag manager, no tracking pixel and no session-replay tool anywhere on this site or in the product. That is why there is no cookie consent banner: there is nothing optional to consent to.
Spheromni also stores things in your browser that are not cookies — local storage, an offline database, and a service worker cache. None of it is sent anywhere. It is listed below because it is data on your device even though no cookie law calls it a cookie.
Cookies
spheromni_session — holds your Spheromni session token, which is what keeps you signed in. Strictly necessary: without it there is no way to know who you are, and no part of the product works. Set when you sign in, deleted when you sign out. Lifetime 30 days. Attributes: HttpOnly (unreadable by any script, including Spheromni's own), Secure, SameSite=Lax (never sent on a cross-site POST), path /. First-party.
spheromni_oauth_state — holds the one-time anti-forgery value and the provider name for a sign-in you have just started, so the callback can prove the reply belongs to the request you made. Strictly necessary, and a security control rather than a convenience. Set when you press a sign-in button and cleared as soon as the round trip finishes. Lifetime 5 minutes. Attributes: HttpOnly, Secure, path /, and SameSite=Lax for every provider except Apple, whose sign-in returns by a cross-site POST and therefore requires SameSite=None. First-party.
That is the complete list. No other cookie is set by Spheromni, and no third party sets a cookie through Spheromni, because no third-party script is loaded on any page — the content security policy would block one.
Local storage in your browser
These keys hold preferences and workspace state on this device. They are readable by scripts on this origin, they are never transmitted to Spheromni, and clearing site data removes them.
spheromni.window-layout.v1— the position and size of your windows, so your workspace reopens as you left it. Kept until you clear it or your browser evicts it.spheromni.shell-cache.v1— whether the drawer was open and which object was selected in the workspace, for the same reason.spheromni.personalization.v1— your theme, icon pack and environment preferences.spheromni.workspace-templates.v1— workspace templates you saved.spheromni.clock.time-format.v1— whether the Clock shows a 12- or 24-hour time.spheromni.voice.history-enabled.v1— whether you asked Spheromni to keep a local voice history.spheromni.voice.history.v1— that history, when you enabled it: the text of commands you spoke, on this device only. Turning history off deletes it.
This list was compiled by reading every localStorage key declared in the shell and the window manager. If you find one not named here, it is an error in this document and worth reporting to [PRIVACY CONTACT — TBD].
Offline database
An IndexedDB database named spheromni-offline.v1 holds three things so that Spheromni keeps working without a network: the text of files you opened, edits you made while offline and have not yet sent, and a list of recently opened file names. Queued edits are documents the server has never seen.
All of it is device-only. Signing out deletes the whole database — and if unsent edits would go with it, you are told how many before the sign-out completes. Spheromni deliberately does not ask the browser to make this storage persistent, so ordinary browser eviction still applies to it.
Service worker caches
Cache Storage entries whose names begin with spheromni-sw. hold the application shell document and the content-hashed build output, so Spheromni opens without a network. These are the same bytes for every visitor and contain nothing about anyone. The service worker never handles requests to /api/, so no response about your account is ever stored in an HTTP cache. Signing out deletes these caches too.
What Spheromni does not do
No advertising cookies. No third-party analytics cookies, and no analytics provider at all — the only measurement in the product is first-party performance telemetry stored in Spheromni's own database, off unless you turn it on, described in the Privacy Notice. No cross-site tracking, no device fingerprinting, no audience or conversion pixels, and no data shared with an ad network. A release-blocking test scans this application's source for tracker code on every build.
Controlling this
You can block or clear cookies and site data in your browser at any time. Clearing the session cookie signs you out; clearing the rest resets your workspace preferences and discards anything queued offline. Because both cookies are strictly necessary, blocking them means being unable to sign in, rather than a reduced experience.
Contact
[PRIVACY CONTACT — TBD].