Cookie Policy

Introduction

This Cookie Policy explains how OyeChats uses cookies and similar technologies on our marketing site at oyechats.com, the customer dashboard at app.oyechats.com, and the embeddable chat widget our customers deploy on their own websites.

If you are a customer deciding how to describe the OyeChats widget in your own cookie notice, the section on the widget below is the part you need.

What are cookies?

Cookies are small text files a website places on your device so it can remember you between visits. "Similar technologies" covers anything that does roughly the same job: localStorage and sessionStorage in the browser, the IndexedDB API, pixel tags in emails, and software development kits (SDKs).

Cookies on our marketing site and dashboard

We use a small number of strictly-necessary first-party cookies, plus one analytics category that runs only with your permission where consent is required. We do not run advertising cookies or cross-site advertising pixels on our own properties.

• oyechats_session: Keeps you signed in to the customer dashboard between page loads and protects against session fixation. (Session, cleared on logout)
• oyechats_csrf: Protects state-changing requests from cross-site request forgery attacks. (Session)
• oyechats_consent: Remembers your cookie banner choice, on the marketing site and in the customer dashboard. (6 months)

Analytics cookies, set by Google Analytics via Google Tag Manager on oyechats.com only:

• _ga: Distinguishes one browser from another so we can count returning visitors. (2 years)
• _ga_E5ZZ461R8T: Holds the session state for our Google Analytics property. (2 years)

Visitors in the EEA, the UK, and Switzerland are asked to consent before either analytics cookie is set, and neither is set if you decline. Elsewhere they are set by default and you can turn them off at any time from "Cookie preferences" in the footer. We also treat a Global Privacy Control signal as a decline.

The embeddable chat widget

The OyeChats widget stores a single anonymous session identifier so a conversation stays continuous for the same Visitor. That identifier is not tied to a name, an email address, or an account unless the Visitor submits one through a lead-capture form.

Primary storage is localStorage, under the key chat_session_id_[bot key]. Because localStorage is partitioned per origin, the widget also writes first-party cookies so a conversation survives a move between subdomains of the site it is embedded on:

• oyechats_sid_[bot key]: Mirrors the anonymous session identifier, scoped to the parent domain of the site the widget is embedded on, so a Visitor moving from example.com to help.example.com keeps the same conversation. First-party, SameSite=Lax, Secure on HTTPS. (30 days)
• __oye_apex_probe: A throwaway cookie written and immediately deleted the first time the widget loads on a hostname, to work out which parent domain the browser will accept a cookie for. It holds no data about the Visitor and does not persist. (Deleted immediately)

These are first-party cookies on the customer's own domain, not OyeChats cookies, and they are strictly necessary for the chat function the Visitor initiated. Cross-subdomain continuity is enabled by default, using an automatically detected parent domain; customers can restrict the scope by setting an explicit share domain in the dashboard under Channels. If the browser refuses cookies, the widget falls back to localStorage alone and the chat still works, without continuity across subdomains.

The widget sets no advertising, analytics, or cross-site tracking cookies, and does not track Visitors across websites belonging to different customers. Session storage is namespaced per bot, so a Visitor who chats on two OyeChats-powered sites is not linked between them.

Your choices and controls

You can control cookies in several ways:

• Browser settings: most browsers let you block, delete, or be warned about cookies on a per-site basis.
• Marketing site banner: if a consent banner is shown on oyechats.com in your region, you can accept or decline non-essential categories there.
• In the widget: starting a new chat clears the stored session identifier and expires the continuity cookie.
• Widget scope, for customers: if you operate a site that embeds the OyeChats widget, you can narrow cross-subdomain continuity to a specific domain from your dashboard under Channels.

Blocking strictly-necessary cookies will break sign-in and other core flows on the dashboard.

Do Not Track and Global Privacy Control

Browsers can transmit a Do Not Track (DNT) header or a Global Privacy Control (GPC) signal. We honor GPC where transmitted: when GPC is detected, we treat it as an opt-out of any sale or sharing of personal information for the purposes covered by the CCPA / CPRA. We do not respond to DNT, which has no agreed meaning across browsers.

Changes to this policy

We may update this Cookie Policy from time to time to reflect changes in technology, applicable law, or our practices.

Questions

Have a question about how we use cookies? Write to support@oyechats.com and we will respond within 14 days.