Cookie and Browser Storage Policy (Controlled Draft)

1. Current Source Audit Finding

A source-code audit of the supplied OperelliOS public-site ZIP found no application references to analytics libraries, advertising pixels, cookies, localStorage, sessionStorage, or common analytics providers.

This is not a complete production cookie audit. The hosting platform, reverse proxy, embedded resources, consent tooling, or future changes may introduce storage or tracking not visible in the source ZIP.

[ENGINEERING VERIFICATION REQUIRED: Inspect the deployed site using browser developer tools and network/storage audits before publication.]

2. Strictly Necessary Technologies

Strictly necessary technologies may be used where required to deliver a requested service, protect security, maintain authentication, preserve load-balancing state, or remember a user’s privacy choices.

The public marketing website should avoid nonessential storage unless there is a documented product need.

[ENGINEERING VERIFICATION REQUIRED: Identify every cookie, local-storage key, session-storage key, and host-injected identifier, including purpose, provider, duration, and domain.]

3. Analytics

No analytics provider is declared by this draft.

Before analytics is added, OperelliOS should document the provider, event schema, identifiers, retention, geographic scope, consent requirements, opt-out controls, and whether cross-site or cross-context activity is used.

[PRODUCT DECISION REQUIRED: Decide whether privacy-preserving analytics is needed for the public MVP.]

4. Advertising and Marketing Technologies

No advertising pixel, retargeting technology, or cross-context behavioral advertising is declared by this draft.

Such technology must not be added silently. It requires product approval, privacy review, vendor disclosure, consent or opt-out controls as applicable, and updates to this Policy and the Privacy Policy.

5. Third-Party Content and Links

External links do not by themselves place third-party cookies through the OperelliOS page, but embedded videos, forms, chat tools, maps, or social widgets may do so.

[ENGINEERING VERIFICATION REQUIRED: Audit all embedded resources and externally loaded scripts, fonts, images, forms, and widgets.]

6. Consent and Choices

Where nonessential technologies require consent, they should remain disabled until valid consent is obtained. Rejecting nonessential technologies should not prevent access to the basic public website.

Where applicable, users should be able to change their choices as easily as they gave them.

[LEGAL REVIEW REQUIRED: Determine consent and opt-out requirements for target jurisdictions.] [ENGINEERING VERIFICATION REQUIRED: Confirm consent-storage and tag-blocking behavior.]

7. Technology Inventory

Publish the final inventory only after production verification.

Technology	Provider	Purpose	Duration	Status
[ENGINEERING VERIFICATION REQUIRED]	TBD	TBD	TBD	No verified production inventory yet

8. Changes

This Policy should be updated when a technology, provider, purpose, or duration changes materially. The inventory should be reviewed as part of every public-site release that changes scripts, embeds, hosting, or analytics.

9. Questions

Questions about cookies or browser storage: [LEGAL REVIEW REQUIRED: Confirm legal and privacy contact email]