Cookie Policy
Draft · Awaiting legal review
DRAFT — needs legal review. This text is a working draft and is not yet in force.
This Cookie Policy explains how [Company legal name] ("Quvos") uses cookies and similar technologies on quvos.dev (the platform) and quvos.io (our marketing site). It supplements our Privacy Policy. Apps and previews that customers build and serve on quvos.app are operated by those customers, who decide which cookies their apps use and are responsible for them.
1. What cookies are
Cookies are small text files that a website stores in your browser and reads back on later requests. "Similar technologies" include the browser's local storage, which keeps small values on your device without sending them with every request.
Cookies can be first-party (set by the site you are visiting) or third-party (set by another domain), and session cookies (deleted when you close the browser) or persistent cookies (kept until they expire or you delete them).
2. Our approach
Today Quvos uses only strictly necessary, first-party cookies. They are needed to sign you in, keep your session secure and protect you against cross-site attacks. We do not use advertising cookies, social media trackers or third-party analytics cookies.
Because these cookies are essential for a service you have asked for, they do not require consent under the ePrivacy rules in the EU, and under the Turkish Personal Data Protection Law No. 6698 they are processed on the basis of the performance of a contract and our legitimate interest in security (Art. 5(2)(c) and (f)). If we ever add analytics or other non-essential cookies, we will ask for your consent first and you will be able to change your choice at any time.
3. Cookies we use
| Name | Purpose | Duration | Properties |
|---|---|---|---|
__Host-quvos_account | Your account session on quvos.dev | up to 30 days | First-party, Secure, HttpOnly, SameSite=Strict |
__Host-quvos_session | Your session in one workspace; bound to that workspace only | the workspace's session setting (by default up to 30 days) | First-party, Secure, HttpOnly, SameSite=Strict |
__Host-quvos_csrf | Protection against cross-site request forgery; readable by the page so it can be sent back with requests | same as the session | First-party, Secure |
__Host-quvos_ops | Operator console session, used by Quvos staff only | up to 8 hours (ends after 30 minutes unused) | First-party, Secure, HttpOnly, SameSite=Strict |
quvos_account_mfa | Remembers a pending second-factor step during sign-in | a few minutes | First-party, Secure, HttpOnly, SameSite=Strict |
quvos_account_webauthn | Holds the challenge while you sign in or register with a passkey | a few minutes | First-party, Secure, HttpOnly, SameSite=Strict |
| sign-in state cookie | Sealed, short-lived state that protects the round trip to Google, Microsoft or GitHub during sign-in | a few minutes | First-party, Secure, HttpOnly, encrypted |
The __Host- prefix means the browser only accepts the cookie over HTTPS, for the exact host that set it and for the whole site, which prevents other subdomains from overwriting it.
When you sign in with Google, Microsoft or GitHub you are briefly sent to that provider's own website, which may set its own cookies under its own policy. Payment pages of Stripe or iyzico may likewise set cookies needed for secure payment and fraud prevention under their own policies.
4. Local storage
| Key | Purpose | Duration |
|---|---|---|
| UI preferences | Remembers your theme (light or dark) and interface language | until you clear it |
These values stay in your browser and are not used to track you.
5. Managing cookies
You can view and delete cookies in your browser settings, and block cookies for our domains. Because all our cookies are strictly necessary, blocking them will stop sign-in and the platform from working. Deleting them signs you out. You can clear local storage from your browser's site settings; your theme and language will return to their defaults.
Useful links:
6. Changes
If we change the cookies we use, we will update this page and its version. Before introducing any non-essential cookie we will update this policy and ask for consent.
7. Contact
Questions about cookies: [email protected]. [Company legal name], [address].