Cookie Policy

Last updated: 5 August 2026

This Cookie Policy explains how OMG IQ ("OMG IQ", "we", "us", or "our") uses cookies and similar

technologies on the omgiq.com website (the "Site") and in the OMG IQ quality platform (the

"Service"). It supplements our Privacy Policy and forms part of our

In short. OMG IQ uses a single first-party, HttpOnly authentication cookie to keep you signed

in, plus a session identifier for support and abuse-prevention. We do not use advertising or

cross-site tracking cookies. The only third-party measurement on the Site is **Cloudflare Web

Analytics, which is cookie-less** by design.

1. What are cookies?

Cookies are small text files a website asks your browser to store, identified by a name and a value,

and to send back on later requests. They are widely used to make websites work, to remember your

preferences, and to measure how a site is used. We group the cookies and similar technologies we use

into the categories below.

2. Categories of cookies we use

2.1 Strictly necessary cookies

These cookies are essential to the operation of the Site and the Service — without them, sign-in,

session continuity, and security features would not work. They are set in response to your actions

(such as submitting the sign-in form) and do not require consent under the ePrivacy Directive and

equivalent rules (UK PECR, CPRA, LGPD, etc.).

| --- | --- | --- | --- |

| __Host-omgiq-auth | First-party, HttpOnly, Secure, SameSite=Lax authentication token that keeps you signed in across requests. | 30 days, sliding | OMG IQ (first-party) |

| __Host-omgiq-csrf | First-party, HttpOnly, Secure, SameSite=Strict token used to mitigate cross-site request forgery on state-changing requests. | Session | OMG IQ (first-party) |

| omgiq_sid | OMG IQ server-side session identifier cookie (the value is opaque; the canonical session record lives on the server). Used for support, rate limiting and abuse prevention. | Session | OMG IQ (first-party) |

We use the __Host- cookie name prefix so the browser refuses to set these cookies unless they are

Secure, do not carry a Domain attribute, and are set on a path of / — a defense against

subdomain takeover and downgrade attacks.

2.2 Preference cookies

We do not currently set any preference cookies. If we add them in the future (for example, to

remember a preferred locale or a UI density), we will list them here and request consent where

required.

2.3 Analytics cookies

We do not set any first- or third-party analytics cookies. We use Cloudflare Web Analytics

on the public Site (the marketing pages at omgiq.com). Cloudflare Web Analytics is cookie-less

— it does not set cookies, does not fingerprint your device, and does not collect personal data. It

measures aggregate traffic to the Site so we can improve it.

The Cloudflare beacon is permitted by our Content Security Policy (script-src allows

https://static.cloudflareinsights.com).

2.4 Advertising cookies

We do not use advertising cookies, third-party ad networks, or cross-site tracking of any kind.

We do not share the Site's first-party analytics with ad platforms.

3. Local storage and similar technologies

In addition to cookies, the Service uses a small amount of browser local storage for things you

can ask for explicitly:

the last-selected project in the OMGPM view (so the picker remembers your choice between visits

to the same workspace);

client-side UI preferences such as the chosen density and theme — these are stored on your

device and never sent to a third party.

You can clear these via your browser's site-data controls; clearing them only resets the UX state, not

your account or any content.

4. Your choices

Strictly necessary cookies cannot be disabled — the Site and the Service will not function

without them.

Browser controls. You can block or delete cookies via your browser's privacy settings. Most

browsers let you clear all cookies on close, or block third-party cookies while keeping

first-party cookies. Note that blocking the strictly necessary cookies will sign you out.

Global Privacy Control. If your browser sends the Sec-GPC: 1 signal (Global Privacy Control),

we treat it as a request to opt out of any non-essential tracking. Because we already avoid

advertising cookies and use a cookie-less analytics provider, the signal has no further effect on

the Site today; we honor it for any future optional measurement.

Do Not Track. Some browsers send a DNT: 1 signal. We do not currently honor DNT for the

reasons the W3C working group disbanded without reaching consensus; however, our use of cookies is

already limited to the strictly necessary category on the Service, and the Site's analytics is

cookie-less.

5. Updates to this policy

We may update this Cookie Policy as the Site or the Service evolves (for example, if we add a new

first-party preference cookie or change our analytics provider). The "Last updated" date at the top

of this page will reflect the change. Material changes will also be announced via the in-product

notice where required by law.

For questions about cookies or this policy, email [email protected]. For the underlying data

practices, see our Privacy Policy.