Status: DRAFT — FOR LEGAL REVIEW
Version: 0.2
Date: 2026-10-18
Owner: Data Protection Officer (to be appointed)
Jurisdiction: Canada (operating company); EU users served under the DSA and GDPR; market neutral
Applicable law: Personal Information Protection and Electronic Documents Act (PIPEDA); for EU users, Directive 2002/58/EC (ePrivacy) as implemented in member-state law and GDPR Art. 6 and 7
Reviewed by counsel: [pending]
This document is a draft prepared for review by qualified legal counsel. It is intended to become the public-facing cookie disclosure Aurora serves in conjunction with the Privacy Policy.
1. What Are Cookies?
A cookie is a small text file stored on your device by a website you visit. Similar technologies include localStorage, sessionStorage, IndexedDB, and server-set tracking identifiers. In this policy, "cookies" refers to all such technologies that store or read data on your device, as covered by Art. 5(3) of the ePrivacy Directive and the national laws of EU member states implementing it, and by PIPEDA for users in Canada. Aurora applies the same consent standard to every user wherever they are.
2. Why We Use Cookies
Aurora uses cookies to:
- Keep you logged in and maintain your session securely (strictly necessary).
- Remember your language, theme, and interface preferences (functional).
- Measure — in aggregate — how the Platform is used so we can improve it (analytics, consent-based only).
Aurora does not use cookies for:
- Advertising or retargeting.
- Cross-site tracking.
- Building profiles for sale to third parties.
- Any third-party ad network.
Aurora does not load third-party ad tags, social-media tracking pixels (Meta, X, TikTok), or analytics from US-based providers (Google Analytics, Mixpanel, etc.).
3. Categories and Legal Basis
Aurora classifies cookies into three categories. Consent is obtained via a compliant consent banner before any non-strictly-necessary cookie is set, in line with ePrivacy Art. 5(3) and the GDPR standard of consent (Art. 4(11) and Art. 7), which Aurora applies to all users regardless of location.
| Category | Legal basis | Consent required? |
|---|---|---|
| Strictly necessary | ePrivacy Art. 5(3) exemption — strictly necessary for the service requested by the user | No |
| Functional | Art. 6(1)(a) GDPR and ePrivacy Art. 5(3) — consent | Yes |
| Analytics (first-party, aggregated, privacy-preserving) | Art. 6(1)(a) GDPR and ePrivacy Art. 5(3) — consent | Yes (see 3.1) |
| Advertising | — | Not used |
3.1 Analytics exception
Under guidance from several EU data protection authorities, certain first-party, anonymized, non-tracking analytics can qualify as having "no or slight impact" on privacy and be exempt from consent. Aurora configures its self-hosted analytics (see below) to meet that bar where possible, but conservatively still gates analytics behind consent in the banner until legal review confirms the exemption applies.
4. Cookies We Use
The table below lists the cookies Aurora sets or reads. Exact names may change as the infrastructure evolves; this table is maintained by the engineering team and version-controlled alongside the consent manifest.
| Name | Purpose | Category | Type | Duration | Origin |
|---|---|---|---|---|---|
aurora_session | Server session identifier; keeps you logged in | Strictly necessary | HTTP cookie, HttpOnly, Secure, SameSite=Strict | Session | auroramembers.com |
aurora_csrf | CSRF token binding per request | Strictly necessary | HTTP cookie, Secure, SameSite=Strict | Session | auroramembers.com |
aurora_refresh | Rotating refresh-token for short-lived JWTs | Strictly necessary | HTTP cookie, HttpOnly, Secure, SameSite=Strict | 30 days (rotated on use) | auroramembers.com |
aurora_age_gate | Records that you have confirmed you are of legal age | Strictly necessary | HTTP cookie | 30 days | auroramembers.com |
aurora_consent | Records your cookie preferences | Strictly necessary | HTTP cookie | 12 months | auroramembers.com |
__cf_bm | Cloudflare bot-management and DDoS mitigation | Strictly necessary | HTTP cookie | 30 minutes | Cloudflare (WAF/CDN) |
aurora_locale | Remembers your language preference | Functional | HTTP cookie | 12 months | auroramembers.com |
aurora_theme | Remembers your dark/light theme preference | Functional | localStorage | Persistent until cleared | auroramembers.com |
aurora_region_hreflang | Remembers your preferred country/region for listing | Functional | HTTP cookie | 12 months | auroramembers.com |
aurora_ga_first_party (planned) | First-party, aggregated analytics (self-hosted Plausible or Umami) | Analytics | HTTP cookie or no-cookie fingerprint-free hash | 24 hours | auroramembers.com |
| Sentry EU session replay (planned, off by default) | Error reproduction on explicit user consent only; PII-scrubbed | Analytics | localStorage | Session | sentry.io (EU region) |
Third-party cookies. Aurora keeps third-party cookies to the minimum required for platform operation. The only third-party cookies expected are those set by Cloudflare for bot management and, if enabled by user consent, Sentry EU for error reporting. No advertising or social-media tracking cookies are set.
5. Consent Mechanism
On your first visit, Aurora shows a consent banner that:
- Does not pre-tick any optional categories (in line with ePrivacy and the CJEU ruling in Planet49 C-673/17).
- Gives equal prominence to "Accept all", "Reject all", and "Customize".
- Lets you accept or reject per category.
- Does not set any functional or analytics cookie before a decision is made.
- Records your decision in
aurora_consentso we remember it. - Re-prompts after 12 months or whenever the cookie list materially changes.
Until you make a choice, only strictly necessary cookies are set.
6. Changing Your Preferences
You can change your cookie preferences at any time:
- Click Cookie Preferences in the Platform footer.
- Clear your browser cookies for auroramembers.com — the banner will reappear on your next visit.
- Use your browser's built-in cookie and tracking-protection controls.
Withdrawing consent does not affect prior lawful processing and does not affect strictly necessary cookies.
7. Do Not Track and Global Privacy Control
Aurora honours the Global Privacy Control (GPC) signal as an expression of opt-out from any processing that requires consent. If your browser sends GPC, we treat it as a "reject all" for optional cookies.
8. Relationship to the Privacy Policy
This Cookie Policy is part of and should be read together with the Aurora Privacy Policy (privacy-policy.md), which describes how personal data is processed more broadly, your GDPR rights, and how to contact the DPO.
9. Changes to This Policy
We may update this Cookie Policy when we add, remove, or change cookies. Material changes are notified via an in-product banner and will re-trigger consent where legally required.
DRAFT — FOR LEGAL REVIEW. The cookie list and durations must be verified against the final deployed stack before publication. Placeholder domains and tool selections (analytics provider) must be finalized.