Version 1.0 (first public launch baseline)
Cookie & Local Storage Policy
Last updated: 2026-10-16
Governing Language: This agreement is formulated and executed exclusively in the English language. Any localized translations provided elsewhere are for convenience only, and this English version shall govern and prevail in all aspects of interpretation and dispute resolution.
Purpose of this Policy
This Cookie & Local Storage Policy explains, in plain English:
- Why Eastern OS uses cookies and similar technologies;
- How we categorize those technologies (necessary, functional / preferences, security / edge, payment / checkout);
- How browser-local storage (including IndexedDB / local storage in your current browser profile) is used for chat, deliverables, and preferences—and what it is not;
- What we do not use as a launch marketing-tracking posture;
- Controls you have to clear or limit site data; and
- How this page relates to the Privacy Policy, Terms of Service, Disclaimer, and Refund Policy.
Related policies you should also read:
This Policy covers cookies, similar browser technologies, and client-side storage used in connection with Eastern OS. It does not redefine PASS packaging, refund eligibility, professional-advice boundaries, or the full inventory of personal-data processing—those live in the Terms, Refund Policy, Disclaimer, and Privacy Policy.
By continuing to use Eastern OS after being presented with this Policy (including via Cookie Settings / related notices), you acknowledge the practices described here. Where applicable law requires consent for non-essential technologies, we will request it in the manner shown in the then-current UI.
1. Our approach
Eastern OS uses cookies and similar technologies for:
- Basic operation of the site and application;
- Session continuity (keeping you signed in / recognizing an active session where accounts are used);
- Preferences (for example locale, theme, and disclaimer / entry-gate assent markers);
- Security and edge protection (bot mitigation, abuse prevention, infrastructure reliability); and
- Billing / checkout flows when you purchase a PASS or start a subscription (technologies set by the payment processor / merchant-of-record / checkout host actually integrated at launch).
We do not sell your navigation data to data brokers as a business model, and we do not operate marketing tracking cookies / advertising pixels as a core Eastern OS monetization practice at launch. If tooling changes, this Policy and the Privacy Policy must be updated together.
Identifiers may change. Exact cookie names, storage keys, and library prefixes can change with infrastructure, auth providers, hosting, and client releases. Tables below describe categories and purposes. Where example identifiers are shown, they are illustrative of technologies commonly present in stacks like ours—or known from product architecture—and Engineer must sync live names before ship. Do not treat any single example string as a permanent inventory.
2. Categories of cookies and similar technologies
2.1 Strictly Necessary
These technologies are required for Eastern OS to load, stay stable, authenticate accounts where used, and complete essential security or routing functions. Disabling them in the browser may break sign-in, checkout, or core application mechanics. They are not used for advertising.
| Category / purpose | Typical setter | What it does | Duration (typical) |
|---|---|---|---|
Account authenticationsb-access-token, sb-refresh-token(plus provider-prefixed Supabase auth cookies such as sb-<project-ref>-auth-token when the hosted auth client sets them) | Eastern OS / Supabase auth | Keeps you signed in and authorizes account actions (PASS ledger, billing portal). Cleared on account delete / sign-out flows that wipe these names. | Session and/or provider-defined refresh windows |
OAuth popup handoffeasternos_oauth_popup | Eastern OS client (lib/auth/oauth-popup.ts) | Short-lived marker while an OAuth popup completes sign-in. | ~10 minutes (Max-Age=600), then cleared |
| Locale / routing | Eastern OS / next-intl | Locale is driven by the URL prefix (/en, /zh, …). localeDetection is off — we do not set a NEXT_LOCALE cookie as of this inventory. | N/A (URL), not a cookie |
2.2 Functional / preferences
These improve convenience and remember choices you make. They are not required for raw backend computation, but clearing them may re-prompt gates or reset appearance.
| Category / purpose | Typical setter | What it does | Duration (typical) |
|---|---|---|---|
Disclaimer / entry-gate assenteasternos_disclaimer_v1.0 | Eastern OS client (components/disclaimer/disclaimer-modal.tsx) | localStorage marker that you acknowledged the entry disclaimer / age themes so we do not re-prompt on every refresh in this browser profile. Version suffix follows siteConfig.disclaimerVersion. | Until cleared, or when the gate version string changes |
Pending checkout intentpending_intent | Eastern OS client (lib/auth/pending-intent.ts) | localStorage JSON remembering the plan you chose (Buy Pass / subscription) so checkout can resume after login. | Until checkout completes or cleared |
Pending paywall unlockpoju_pending_paywall_unlock, poju_completed_paywall_unlock | Eastern OS client (sessionStorage) | Remembers a paywall unlock to finish after Pass purchase return. | Session tab lifetime |
Other UI / product state (examples)pojulife_chat_welcome_seen_*, archive/runtime keys, product flow session keys | Eastern OS client | Non-chat UI friction reducers (welcome toast, archive runtime lists, in-flow session flags). Not used for advertising. | Until cleared / as configured |
| Theme / UI preference | Eastern OS client / CSS | Landing and app use dark starfield styling; no dedicated NEXT_THEME cookie was found in this inventory. Appearance may still follow system / page class. | N/A or until cleared |
2.3 Security / edge
| Category / purpose | Typical setter | What it does | Duration (typical) |
|---|---|---|---|
| Edge / bot mitigation | Cloudflare (and/or comparable edge) | Security cookies commonly used to distinguish legitimate traffic from automated abuse (example family often includes identifiers such as cf_clearance when Cloudflare challenge/clearance flows are active). Exact names and lifetimes follow Cloudflare’s then-current behavior. | Provider-defined (often days to weeks for clearance-style cookies) |
| Hosting / edge operational cookies | Vercel and/or Cloudflare (as used for hosting / delivery) | May support routing, reliability, and infrastructure controls. Not used by Eastern OS as advertising trackers. | Provider-defined |
2.4 Payment / checkout
When you start checkout or manage billing:
| Category / purpose | Typical setter | What it does | Duration (typical) |
|---|---|---|---|
| Checkout / fraud / billing state Set by the checkout / MoR host; names as shown on the hosted checkout domain | Payment processor / merchant-of-record / checkout host actually integrated at launch | Cookies or similar technologies set by that provider (or on its hosted checkout domain) for secure payment, fraud prevention, and subscription / purchase state matching. Never used by Eastern OS as advertising pixels. Eastern OS does not hardcode third-party payment cookie names here—the provider name on your receipt controls. | Session and persistent, per provider rules |
First-party checkout handoff (measured)pending_intent (localStorage) | Eastern OS client | Remembers which PASS plan / quantity to buy before redirect to the hosted checkout. Not a payment-card cookie. | Until checkout resumes or cleared |
The exact provider name shown at live checkout and on your receipt controls. Eastern OS does not list third-party payment cookie names in this Policy in a way that hardcodes a vendor that may change. Payment-related cookies are those set by the payment provider / checkout host as shown at checkout.
Eastern OS does not intend to store raw full card Primary Account Numbers on its own servers. See the Privacy Policy and Refund Policy.
3. Local storage / IndexedDB (browser-local chat & deliverables)
3.1 What stays in your browser
Eastern OS is designed so that dialogue / chat content and related in-browser deliverables (for example reports and same-line reminder content as presented in-product) are stored primarily in browser-local technologies such as IndexedDB and local storage in the current browser profile—not as a cloud chat archive synced through your account.
This local layer may include, depending on the then-current client:
- Multi-turn decision dialogue history and related session artifacts for the unified Eastern OS dialogue experience;
- In-browser deliverables associated with a PASS line of work (for example report / reminder presentation state);
- Preference and assent markers described above;
- Other client-side caches needed for a smooth local experience.
Measured client stores (engine inventory 2026-10-16): dialogue / session / archive rows use an IndexedDB database via Dexie in lib/db/poju-db.ts (database name as configured in that module — measured name pojulife_v4 on this origin). Assent and checkout handoff keys in localStorage / sessionStorage are listed in the tables above. Identifiers can change with client releases.
Storage may be protected or organized as implemented in the then-current client. This Policy does not warrant a specific encryption algorithm as a universal property of all local stores. See the Privacy Policy for the accurate “browser-local” product statement.
3.2 What is not “primary truth” in local storage
PASS balances, subscription entitlements, and billing ledgers are account / server-side (subject to the Privacy Policy and Terms). Local storage is not the authoritative billing ledger.
Your account holds PASS / billing state. A receipt email confirms billing—it is not a backup of your chat history. To retain chat / deliverables beyond the current browser profile, use export / email (or other retention features) where offered.
3.3 Loss risks
Because chat / deliverables are browser-local, they may be permanently lost if, for example, you:
- Clear site data / cache / cookies / IndexedDB / local storage for easternos.com;
- Use or close an Incognito / Private window;
- Switch browsers, devices, or browser profiles;
- Uninstall a PWA / clear app storage; or
- Use aggressive privacy extensions that wipe origin storage.
Eastern OS does not restore a cloud chat archive we do not keep. Accidental or user-caused local loss does not, by itself, create a refund or free PASS restoration—see the Refund Policy and Terms.
3.4 In-product wipe / clear controls
Where the then-current product offers in-app wipe controls (for example “End & Wipe” style actions), you may use them to clear local session / chat data as designed in that UI. Otherwise—or in addition—you can clear site data for easternos.com in your browser settings.
Clearing local chat does not automatically delete server-side account / PASS / billing records. For account-held personal data requests, contact privacy@easternos.com (see Privacy Policy).
4. What we do not use (launch posture)
As a launch posture, Eastern OS does not intentionally embed the following as product defaults for behavioral advertising or cross-site retargeting:
- Google Analytics (or equivalent general web analytics marketed primarily for advertising funnels);
- Hotjar (or equivalent session-recording / heatmap marketing tools);
- Meta (Facebook) Pixel, TikTok Pixel, Google Ads cross-site retargeting markers;
- Hidden third-party identity harvesters built to profile shopping behavior for ad networks.
This section describes intent and launch tooling posture. Engineer must verify the production bundle before go-live. If any of the above (or similar) is later added, this Policy and the Privacy Policy will be updated.
We still use operational security, hosting, auth, email, AI generation, and payment processors as described in the Privacy Policy—those are not “ad pixels,” but they do process data as needed to run the Service.
5. User controls
You can typically:
- Review cookies for easternos.com in your browser’s site settings / developer tools;
- Block or delete cookies in your browser (note: blocking necessary cookies may break sign-in, security challenges, or checkout);
- Clear site data (cookies, local storage, IndexedDB) for easternos.com;
- Use in-product wipe controls where offered;
- Export / email chat or deliverables before wiping, when those features are available;
- Sign out / close account flows as described in Terms / Privacy for server-side account data;
- Contact privacy@easternos.com for privacy requests about account-held data.
Eastern OS does not claim a universal “opt out of all strictly necessary cookies while still using the full Service.” Necessary technologies are required for core operation where accounts, security, or checkout are used.
Where a jurisdiction requires a consent banner or granular non-essential toggles, the then-current Cookie Settings / banner UI controls those choices. This written Policy is the disclosure; the UI is the control surface.
6. Relationship to the Privacy Policy and other documents
| Document | Role relative to cookies / local storage |
|---|---|
| This Cookie & Local Storage Policy | Categories, purposes, local IndexedDB/chat posture, user controls, launch “what we don’t use.” |
| Privacy Policy | Broader personal-data map: account / PASS / billing vs browser-local chat; processors (including hosting, auth, AI, email, payments); retention; rights. |
| Terms of Service | Account rules, PASS commerce, acceptable use; browser-local data loss vs entitlements. |
| Disclaimer & Sovereignty Architecture | Product boundaries; local-session limits; crisis / age themes summarized in the entry modal. |
| Refund Policy | When payments may be refunded; local data loss generally not refundable by itself. |
If a technical privacy fact here conflicts with the Privacy Policy, prefer the Privacy Policy for storage architecture and processor inventory. If a commercial entitlement / refund rule conflicts with Marketing copy, prefer Terms + Refund + checkout / receipt.
7. Changes
We may update this Policy when infrastructure, auth, payment, or client storage behavior changes. Material updates will be reflected by a new Last updated date and Version stamp at the top of this page. Continued use after posting constitutes acknowledgment of the updated Policy to the extent permitted by law. Where consent is required for new non-essential technologies, we will request it as shown in the then-current UI.
Subsequent infrastructure deployments may change technical cookie designations; revisions will be version-stamped on this page.
8. Contact
| Topic | Contact |
|---|---|
| Privacy / data / cookies | privacy@easternos.com |
| Legal | legal@easternos.com |
| Product / billing support | support@easternos.com |
9. Acknowledgment
By using Eastern OS, you acknowledge that:
- Cookies and similar technologies are used for operation, session, preferences, security, and billing flows as categorized above;
- Chat / deliverables are browser-local in the current browser profile, with real loss risk across clears, Incognito, and device switches;
- PASS / subscription entitlements are account / server-side, not the primary truth of local storage;
- Receipt email ≠ chat backup; export / email for retention where offered;
- We do not sell navigation data to brokers or run marketing tracking cookies as a launch business model (subject to verified tooling);
- Payment cookies are set by the payment provider / checkout host as shown at checkout;
- You are 18+; and
- Detailed personal-data processing is governed by the Privacy Policy.