Cookie & Local-Storage Notice

Translations of this Notice may be provided for convenience. If there is any conflict or ambiguity between the English version and a translation, the English version governs, except where applicable mandatory local law requires otherwise.

Contents

1. 1. What cookies and storage are
2. 2. Summary — what we use
3. 3. Strictly-necessary: sign-in & session
4. 4. Preference: language choice
5. 5. What we do not use
6. 6. Full inventory
7. 7. Legal basis & consent (ePrivacy / GDPR)
8. 8. How to see, clear, or block storage
9. 9. Third-party scripts we load
10. 10. Changes to this Notice
11. 11. Contact

1. What cookies and storage are

A cookie is a small text file a website asks your browser to store and send back on later visits. Local storage and session storage are similar browser features that let a site keep small pieces of data on your device without sending them automatically with every request. This Notice covers all three — together, "storage" — because they raise the same privacy questions even though only some are technically "cookies."

OMLA uses storage for three purposes only: keeping you signed in while you use your account, remembering the display language you pick, and remembering that you dismissed the beta notice banner. All are first-party (set by omla-ai.org itself), and none is used to profile you, follow you across other websites, or serve advertising.

2. Summary — what we use

• Strictly-necessary sign-in/session storage — set only after you sign in to an OMLA account, so the Site can keep you authenticated as you move between pages. Provided by our authentication sub-processor, Supabase, and stored on your own device.
• A language-preference cookie (omla_lang) — remembers which of the Site's languages you selected, so you do not have to re-pick it on every visit.
• A banner-dismissal preference (omla_banner_dismissed_v1, first-party localStorage) — remembers that you dismissed the beta notice banner so it stays hidden on later visits.

That is the entire list. Because everything we use is either strictly necessary or a non-tracking preference you actively set, we do not show a cookie consent wall — but we disclose all of it clearly here, and you can clear or block any of it at any time (see Section 8).

3. Strictly-necessary: sign-in & session

When you sign in to an OMLA account (for example to publish a model or submit a usage report), our authentication provider Supabase stores a session token in your browser so that subsequent pages recognise you as signed in and your sign-in survives a page reload. This is set through the Supabase JavaScript client running in your browser; the token is kept in your browser's local storage on your own device, under a Supabase-managed key (typically named like sb-<project>-auth-token).

This storage is strictly necessary: without it, signing in would not work and you would be logged out on every page. It is created only when you actually sign in — if you simply browse the public Site without an account, no sign-in storage is set. The session is refreshed automatically while you remain active and is removed when you sign out or when it expires.

For more about the account data behind sign-in and our use of Supabase as a sub-processor, see our Privacy Policy.

4. Preference: language choice

The Site is offered in several languages. When you choose a language using the on-page language switcher, we save your choice in a first-party cookie named omla_lang so that the Site loads in that language the next time you visit. The cookie stores only a short language code (for example en, es, or ja) — nothing that identifies you.

This cookie is set with path=/ and SameSite=Lax, is first-party (readable only by omla-ai.org), and is set to expire about one year after your most recent language selection. It is a preference item, not a tracker: if you never change the language, or you decline this cookie, the Site still works — it simply falls back to your browser's language setting (and to English if that is not one of the supported languages).

5. What we do not use

OMLA does not use, and does not allow third parties to set on this Site:

• advertising or ad-targeting cookies;
• third-party analytics or audience-measurement cookies (no Google Analytics or equivalent);
• session-replay, heatmap, or behaviour-recording tools;
• social-media tracking pixels or "like"/share trackers;
• cross-site tracking, fingerprinting, or data-broker tags of any kind.

We do not sell or share any browsing data, because we do not collect browsing data through trackers in the first place.

6. Full inventory

The table below lists every storage item the Site can set, with its category, where it lives, when it is created, and how long it lasts.

Exact key names for the sign-in item are managed by the Supabase client library and may vary slightly with library versions; the function and category do not change. If we ever add any new storage item, we will update this inventory and the version date at the top of this Notice.

7. Legal basis & consent (ePrivacy / GDPR)

Under the EU/UK ePrivacy rules, storing or reading information on your device requires your prior consent unless the storage is strictly necessary to provide a service you have requested, or it is a non-tracking preference you actively set.

• Sign-in/session storage is strictly necessary to deliver the account service you asked for (staying signed in). It is exempt from the consent requirement and is relied on under our legitimate interest and our contract with you to operate the Site.
• The language cookie stores only a preference you set yourself, contains no identifier, and is not used for tracking. It is treated as functional/strictly-necessary-adjacent storage and does not require a consent wall.

Because every item we use falls into these categories and we run no advertising, analytics, or tracking storage, no cookie consent banner is required and we do not display one. We instead rely on this clear, accessible disclosure. If we ever introduce any non-essential storage that does require consent, we will ask for it through an appropriate consent mechanism before setting it, and we will update this Notice first.

8. How to see, clear, or block storage

You are always in control of cookies and browser storage. You can inspect, delete, or block them at any time without losing access to the public parts of the Site (though clearing sign-in storage will simply sign you out).

Clear or block in your browser

• Chrome: Settings → Privacy and security → Third-party cookies / Site data → "See all site data and permissions," then search omla-ai.org and remove it. Or open Developer Tools (F12) → Application → Storage → Clear site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data, search omla-ai.org, then Remove Selected.
• Safari: Settings → Privacy → Manage Website Data, search omla-ai.org, then Remove.
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data → See all cookies and site data, search omla-ai.org.
• Mobile browsers: use the equivalent "Privacy" or "Clear browsing data" / "Site settings" menu and choose cookies and site data.

Specific items

• Language cookie (omla_lang): clearing site data removes it; it is re-created only if you choose a language again. You can also block first-party cookies for the Site, in which case the Site falls back to your browser's language.
• Sign-in/session storage: the simplest way to remove it is to sign out of your OMLA account, or to clear site data as above. Blocking local storage for the Site will prevent sign-in from persisting.
• Banner-dismissal preference (omla_banner_dismissed_v1): clearing site data removes it; the beta banner simply reappears and can be dismissed again.

You can also use your browser's "private" or "incognito" mode, which discards all site storage when you close the window, and most browsers offer a setting to clear cookies and site data automatically on exit.

9. Third-party scripts we load

To keep the Site lightweight, we load a small number of scripts — and every one of them is served from omla-ai.org itself. That includes the official Supabase JavaScript client (used solely to power account sign-in) and the registration cryptography libraries, which we host first-party rather than loading from a third-party content-delivery network. No externally hosted scripts run on the Site, and none of our scripts set advertising or analytics storage.

Our static Site is hosted by DreamHost; like any web host, DreamHost may keep server access logs for security and operations. Those are server-side logs, not cookies or device storage, and are described in our Privacy Policy. We do not embed third-party advertising or analytics tags.

10. Changes to this Notice

We may update this Notice if the storage we use changes — for example, if we add a new functional item or change a provider. When we do, we will revise the version and "Last updated" date at the top of the page, update the inventory in Section 6, and, where any change introduces non-essential storage, ask for consent before setting it. We encourage you to review this Notice periodically.

11. Contact

Questions about this Notice, or about cookies and storage on the Site, can be sent to our privacy team. For the full picture of how we handle personal data — including the legal bases, sub-processors, international transfers, retention, and your data-subject rights — please read our Privacy Policy.

• Privacy / data protection: privacy@omla-ai.org
• General: hello@omla-ai.org
• Legal: legal@omla-ai.org

The Open Model Licensing Association ("OMLA") is an open, community-governed initiative organizing as a nonprofit in the State of Washington, USA; 501(c)(3) status is pending and not yet granted.