Cookie Policy

What this policy covers

This policy explains how MuroAXO uses cookies, local storage and similar technologies on your device, and how you control optional advertising and preferences. It should be read with the Privacy Notice. Cookies are small files stored by your browser. Local storage is a browser database that remains on your device until you or the site clears it.

We use essential storage to operate MuroAXO and optional storage only after the relevant choice or consent. We do not use advertising cookies or load the MagicAds advertising frame before you press “Accept All”.

Your choice

On your first visit to the MuroAXO app, a consent banner offers two equally prominent choices: Accept All and Reject Non-Essential. We do not load optional advertising or save optional preferences before you choose. Rejecting non-essential storage does not block sign-in, your workspace, project editing, model requests or legal pages.

We record your choice in your browser’s local storage under the key muroaxo-cookie-consent, with the value all or essential. This record contains your choice, not your email or project data. It remains until you change it or clear your browser’s site data. If your browser blocks local storage, the choice lasts only for the open session and we will ask again next time.

To change your choice in the app, open Legals → Cookie settings. You can also clear this site’s data in your browser settings, which resets the banner. Changing from “Accept All” to “Reject Non-Essential” immediately stops new advertising from loading; any storage already placed by MagicAds in its own frame may remain until you clear it or it expires.

Strictly necessary storage

These technologies are needed to provide the Service you request, keep it secure and remember your privacy choice. They are not used for advertising.

• __Host-muroaxo-session — a first-party, HttpOnly session cookie set after you verify a sign-in code. It keeps you signed in, is marked Secure on HTTPS, uses SameSite=Lax, and expires after up to 14 days. The server stores only a hash of the session token.
• muroaxo-cookie-consent — local storage that records whether you chose “Accept All” or “Reject Non-Essential”. It is necessary to honour your choice and does not contain advertising identifiers.
• Cloudflare security technologies — Cloudflare may set essential security or routing cookies, such as bot-management or challenge cookies, when delivering the Service. These are controlled by Cloudflare and are used to protect the site from abuse.

Optional preferences

If you choose “Allow saved preferences” in the app’s storage notice, we store your model preferences, theme and recent conversation history in local storage on this device. The saved settings exclude your provider API key. The storage choice itself is recorded in a first-party cookie named muroaxo-device-storage, which expires after 180 days and stores your allow or deny choice plus an account scope. It is marked Secure on HTTPS and uses SameSite=Lax. Local storage keys may include an account identifier in the key name; they do not contain your API key. If you choose “Continue without saving”, we do not read or write those optional preferences.

You can clear these preferences at any time through your browser settings or the app’s storage controls. Clearing them may remove your theme and recent conversation history from this device.

Optional advertising

Free adult workspaces may show MagicAds placements in the app shell. Advertising is optional and loads only when all of the following are true: you have pressed “Accept All”; the workspace is on the free tier; the account is not flagged as a minor; and a publisher placement is available. Pro workspaces and known minors do not load the advertising frame at all.

The advertising document is loaded in a sandboxed iframe without same-origin access. It cannot read MuroAXO’s first-party cookies or local storage. MagicAds and its advertising partners may set their own cookies or local storage inside that frame, and may receive technical information such as your IP address, browser and device signals, approximate region, the page and placement, and impression or click events. We do not send your prompts, project files or account email to MagicAds. MagicAds’ own privacy and cookie policies govern its processing; see magicads.dev for its current information.

If you reject non-essential storage or have not chosen, the app does not set the ad frame’s source and does not request the MagicAds SDK. It shows a neutral “Ads are off” or “Support MuroAXO by allowing ads” place instead. Accepting advertising does not affect model output or insert ads into model responses.

Analytics and profiling

We do not currently use analytics, attribution or cross-site profiling cookies, and we do not sell personal data. Cloudflare may process aggregate operational and security telemetry to deliver and protect the Service. If we introduce new non-essential technologies, we will update this policy and ask for consent where required before they load.

Third-party services

Some features redirect you to or involve third parties whose storage practices are their own:

• GitHub for sign-in and repository storage. GitHub may set cookies on its own domains during authorization.
• Stripe for checkout and billing. Stripe may set cookies on its checkout and billing pages.
• Your model provider when you send a request. Its API processing is described in its privacy notice; it does not receive your MuroAXO cookies.
• MagicAds only after you accept optional advertising, as described above.

We do not control third-party cookies set on third-party domains. Review the relevant provider’s policy and your browser controls.

How to control cookies and local storage

You can block or delete cookies and local storage through your browser settings. Blocking essential storage may prevent sign-in or break parts of the app. Clearing site data removes your consent record, so the banner will appear again on your next visit. You can also use a private browsing window to avoid persistent local storage; the app will still ask for consent in that session.

Changes to this policy

We may update this policy when we change our storage, providers or legal obligations. The effective date at the top will change with a material revision. Where required, we will ask for fresh consent before new non-essential technologies load.

Contact

For questions about this policy or our use of cookies and local storage, contact Maykesh Saravanan, trading as MuroAXO, Hardwick House, Masons Hill, Bromley, BR2 9GW, England, UK, or email info@leanopsstudio.co.uk. You can also complain to the UK Information Commissioner’s Office at ico.org.uk. Our ICO registration number is pending and will be published as [ICO_NUMBER_PENDING].