1. Current application behavior
The Orylin application sets no first-party cookies and writes no sessionStorage or IndexedDB. localStorage contains only the non-sensitive interface-language and color-theme preference keys orylin.locale and orylin.theme after you choose them; it never contains a session, message or key. The application includes no advertising, cross-site analytics, social tracking pixels or marketing SDK. A refreshed page does not restore a session from persistent browser storage.
The invitation secret is carried in a URL fragment and removed from the address bar after reading. It is not a cookie and is not sent in an ordinary HTTP request.
2. Infrastructure and future changes
Cloudflare may set strictly necessary cookies or process similar identifiers for network security, DDoS protection or challenge services. The current Orylin main site does not enable Turnstile. Any future activation requires a separate review and updated notice.
If persistent preferences, analytics or non-essential cookies are added later, Orylin will first document the item, purpose, provider, duration and control, and provide consent and withdrawal where required. No non-essential cookie banner is currently needed.