Cookies & storage

Current cookie audit

OncoRadar uses the following cookies for authentication, sign-in abuse prevention and language preference. There is no advertising or audience analytics integration.

• __Host-oncoradar_session — essential authentication cookie; secure, HttpOnly, SameSite=Lax, host-only, Path=/, and limited to the authenticated session lifetime.
• oncoradar-locale — functional language preference; secure, SameSite=Lax, host-only, Path=/, available to browser code, and retained for up to one year.
• aws-waf-token — essential encrypted security token set by our cloud security provider's browser integration on the sign-in page, for the current OncoRadar domain. It holds browser/session security signals and challenge completion timestamps. The integration manages its renewal; successful automatic checks are accepted for five minutes and CAPTCHA checks for fifteen minutes, independently of the cookie's storage lifetime. It is available to browser code and does not replace the authenticated session cookie.

Sign-in security checks

The sign-in page loads a security script from our cloud security provider. It checks browser characteristics and automation signals and may collect interaction signals such as mouse movements, keypress events and form interactions to prevent automated abuse. A visual or audio CAPTCHA may be requested after repeated attempts. These signals are used for security, not advertising or audience measurement. OncoRadar does not enable request-body inspection, sampled requests or full request logging for these sign-in firewall rules. The provider is identified in the Subprocessor Notice.

Why no consent banner is shown

The current implementation uses essential authentication and abuse prevention mechanisms and user-requested language and appearance preferences. It has no advertising or audience analytics, so OncoRadar does not present a cookie-consent banner. This is not a claim that every jurisdiction treats storage identically. If non-essential technology is introduced, this notice and any required choices will be updated before activation.

Related local and server storage

Your browser may hold ordinary cache, transient interface state and security-provider state used to obtain and renew the sign-in token. If you choose a light or dark appearance with the theme control, that preference is kept in browser local storage under the key oncoradar-theme; it contains no identifier, is never transmitted to the server, and is removed when you return to the system theme or clear site data. Account, workspace, acceptance, quota and audit data are stored server-side as described in the Privacy Policy. API clients control their own secure storage of the one-time credential secret.

Controls and effects

You may clear browser cookies and site data. Removing the session cookie signs you out locally; removing the locale cookie resets automatic language preference but does not delete account data. Removing the security token causes another check on your next sign-in. Blocking the security script or its storage can prevent sign-in. Contact the privacy address if you observe a storage technology not listed here.