DRAFT — for legal review, not legal advice. This template was generated from Itemra's source code and must be reviewed and finalised by a qualified lawyer before publication. Bracketed [PLACEHOLDER] tokens mark company-specific facts that the founder must supply.

Cookie & Local Storage Policy

Controller: [LEGAL_ENTITY_NAME] ("Itemra", "we", "us"), [REGISTERED_ADDRESS], org. no. [ORG_NUMBER] Effective date: [EFFECTIVE_DATE] · Version: 2026-07-16 Contact: [PRIVACY_CONTACT_EMAIL] · Privacy contact / DPO: [DPO_OR_PRIVACY_CONTACT]

This policy explains the cookies and equivalent client-side storage technologies that the Itemra application uses, why we use them, and your choices. It supplements our Privacy Policy and should be read alongside it. It is linked from the application footer at [POLICY_URL].

1. What this policy covers

When you use the Itemra web application, small amounts of information are stored on, or read from, your device. This happens through two technologies:

• Cookies — small text files a website asks your browser to store and send back on later requests.
• Local storage ("localStorage") — a browser storage area that lets a web app remember your preferences and recent activity on your own device.

Under the EU ePrivacy rules and Norway's Electronic Communications Act (ekomloven, LOV-2024-12-13-76, in force 1 January 2025), storing or reading any information on your device requires your consent — except where the storage is strictly necessary to provide a service you have explicitly requested. Both cookies and local storage are treated the same way under this rule.

This policy therefore covers both, and tells you for each item whether it is strictly necessary (no consent required) or otherwise.

2. The short version

• Itemra uses only strictly-necessary cookies (for signing you in and for security) and functional local storage (to remember your preferences and recent activity on your own device).
• Itemra sets no analytics, advertising, marketing, profiling, session-replay, or third-party tracking cookies or SDKs. We have verified this against our application source code.
• Itemra records privacy-minimised, organisation-level product-usage signals on its own server. This does not read or write browser storage, load an analytics SDK, identify an individual user, or disclose data to an analytics provider; it is described in the Privacy Policy rather than this device-storage notice.
• Because we use only strictly-necessary and functional storage that you set through your own use of the product, no cookie consent banner is required today. This document is an information notice, as the law requires, not a consent record.
• If we ever add non-essential client-side analytics, storage, or tracking technology, we will introduce a proper consent mechanism before it loads, and update this policy. See section 8.

3. Cookies we set

Itemra sets the following first-party cookies (i.e. set under the Itemra application's own domain). Both are classified as strictly necessary and are exempt from consent because they are required to deliver the secure, signed-in service you have asked for.

Source in code: src/backend/infrastructure/Itemra.Integrations.WorkOS/DependencyInjection.cs — itemra_session is configured with HttpOnly = true, SameSite=Lax, a 7-day sliding ExpireTimeSpan, and a Secure policy that is Always in production hosting; itemra_csrf is the anti-forgery cookie with SameSite=Lax and the same secure policy.

Note on "Secure in production": the Secure flag (which restricts the cookie to HTTPS) is applied in deployed/production environments. In local development and automated test environments, which run over plain HTTP, the secure policy follows the request scheme so the app remains usable.

4. Local storage we use

The following keys are stored in your browser's localStorage. They hold functional / preference data that you create through your own use of the product (for example, choosing a language or theme, or using search and scanning). They contain only your interface preferences and your own recent activity on this device; they are not used for tracking, profiling, or advertising, and they are not transmitted to advertising or analytics third parties.

Sources in code: src/web/src/app/AppContext.tsx (itemra.theme, itemra.identity, itemra.density, itemra.sidebar.collapsed); src/web/src/lib/i18n/index.ts (itemra.locale); src/web/index.html (early read of itemra.theme); src/web/src/features/reports/useRecentReports.ts (itemra.reports.recent); src/web/src/features/search/recentSearch.ts (itemra.search.recent); src/web/src/features/scanning/scanOfflineCache.ts (itemra.scan.recent.v1).

Because itemra.search.recent and itemra.scan.recent.v1 can contain text you typed or codes you scanned, they may incidentally include identifying details if you entered such details yourself. They are stored only on your own device, are not sent to us for tracking, and are cleared when you clear your browser storage (see section 7).

5. We do not use tracking technologies

We have verified against the application's source code that Itemra does not set or load:

• analytics cookies or SDKs (e.g. Google Analytics, Google Tag Manager, Plausible, PostHog, Segment, Mixpanel, Amplitude);
• advertising, marketing, or retargeting cookies or pixels (e.g. the Meta/Facebook pixel);
• session-replay, heatmap, or A/B-testing tools;
• any cross-site tracking technology.

The first-party product-usage signals described in the Privacy Policy are created from successful server-side business operations and bounded feature keys sent to Itemra's own API. They do not use cookies, local storage, browser fingerprints, third-party scripts, full URLs, search terms, scan payloads, or session replay, so they are not a client-side tracking technology covered by this inventory.

If this changes, we will update this policy and put a consent mechanism in place before any such technology loads (see section 8).

6. Third-party storage during sign-in, payments, and fonts

A few parts of the service involve other providers. We list them here for transparency; their own cookie practices are governed by their policies, not this one.

• Sign-in (WorkOS AuthKit). When you sign in or sign up, you are taken to our authentication provider's hosted pages. That provider may set its own cookies on its own domain during the sign-in flow, for example to operate its login screens. (Source: authentication is handled via WorkOS — src/backend/infrastructure/Itemra.Integrations.WorkOS/WorkOsService.cs.)
• Payments (Stripe Checkout / Billing Portal). If you start a subscription or manage billing, you are taken to Stripe's hosted checkout or billing portal, where Stripe may set its own cookies on its own domain (including for fraud prevention). Itemra does not collect your card details. (Source: billing is handled via Stripe — src/backend/infrastructure/Itemra.Integrations.Stripe/StripeBillingGateway.cs.)
• Web fonts (Google Fonts). The application loads fonts from Google's font service (fonts.googleapis.com / fonts.gstatic.com). This does not set an Itemra cookie, but the request is made to Google's servers and may convey your IP address and browser type to Google. (Source: src/web/index.html.) — [Founder/lawyer to confirm whether to keep this, or self-host the fonts to remove the third-party request; see open questions.]

For more on the providers in our data path, see our Privacy Policy and subprocessor list.

7. How to control cookies and local storage

You can manage or delete cookies and local storage through your browser settings. Most browsers let you:

• view and delete individual cookies and stored data;
• block or clear local storage for a site;
• block third-party cookies; and
• clear all browsing data on exit.

Browser help: [Chrome], [Firefox], [Safari], [Microsoft Edge] (link these to each vendor's help page when finalising).

Please note: the itemra_session and itemra_csrf cookies are strictly necessary. If you block or delete them, you will not be able to sign in to, or use, the Itemra application. Clearing functional local storage will simply reset your preferences (language, theme, layout) and recent-activity lists to their defaults — the application will continue to work.

8. If we add client-side analytics or tracking later

Itemra is built so that adding any non-essential client-side technology is a deliberate step. Before we introduce any analytics, A/B testing, marketing, session-replay, or other non-essential storage, we will:

• implement a compliant consent mechanism that requests your prior, freely given, specific, informed and unambiguous consent (no pre-ticked boxes; no "continued browsing" treated as consent);
• offer an equally prominent way to reject non-essential storage as to accept it;
• let you withdraw consent at any time, as easily as you gave it;
• keep a record of consent; and
• update this policy with the full details before that technology loads.

Until then, no consent banner is shown because only strictly-necessary and functional storage is used.

9. Legal basis summary

• Strictly-necessary cookies (itemra_session, itemra_csrf): exempt from consent because they are required to provide the secure, signed-in service you explicitly requested (ePrivacy / ekomloven strict-necessity exemption). Where these cookies process personal data (e.g. tied to your account/session), the related processing is described in our Privacy Policy and is based on performance of our contract with you and our legitimate interest in keeping the service secure.
• Functional local storage (preferences and recent-activity keys in section 4): set by your own actions to deliver features you use; treated as strictly necessary / functional and not used for tracking.
• Non-essential technologies: none today. Any future ones will require your consent (see section 8).

10. Changes to this policy

We may update this policy to reflect changes in the technologies we use or in the law. We will revise the version and effective date above and, for material changes (such as the introduction of any non-essential storage), provide a more prominent notice. The current version is always available at [POLICY_URL].

11. Contact and complaints

Questions about this policy or your privacy: [PRIVACY_CONTACT_EMAIL] (privacy contact / DPO: [DPO_OR_PRIVACY_CONTACT]).

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local supervisory authority. Cookie/electronic-communications matters in Norway are supervised jointly by Datatilsynet and the Norwegian Communications Authority (Nkom).

Governing law / venue for this policy: [GOVERNING_LAW_VENUE].