Cookie & Tracking Notice

Company draft for attorney review. Version: launch-draft-3. Intended effective date: September 11, 2026. Operator: Johnathon August Roman, doing business as Pineform Labs. Questions: [email protected].

Necessary browser mechanisms

Yevr uses browser mechanisms necessary for sign-in, account security, and requested app functionality. Some technical identifiers retain the internal `soren_*` naming used by the application implementation; those identifiers are not a separate public product or tracking brand.

The hosted Service sets a secure, HttpOnly session cookie named `__Host-soren_session`. It authenticates your session; the normal server-issued session lasts eight hours unless otherwise configured within the server's permitted bounds. Signing out expires the cookie and revokes that session. Browser expiry is not deletion of historical server-side session records.

The `__Host-soren_login` and `__Host-soren_workspace` cookies bind their respective Google authorization flows to your browser. Each has a five-minute maximum age and is cleared when its flow completes or is handled as failed. They are separate from granting Workspace access. Secure and HttpOnly protections apply to hosted cookies, with SameSite settings appropriate to each flow.

Authenticated changes require a session-bound CSRF proof held by the page in memory and sent in a request header; it is not an advertising identifier. Explicit loopback development uses equivalent development-prefixed cookies. The separate local UI uses `soren_ui_csrf` for request protection and local-storage keys `sorenSessionId` and `sorenVoiceMuted` for the selected conversation and voice preference. Those local-storage values persist until changed or cleared. The hosted command center does not currently use those local preference keys.

Tracking inventory

Current Yevr application source does not include third-party advertising cookies, third-party analytics scripts, or cross-site behavioral tracking. Hosting and identity providers process technical information needed for their services under their own practices. We do not describe those services as incapable of logging requests. Google sign-in and Workspace consent occur on Google's service, where Google's own notices apply.

Your choices

You can clear or block cookies and local storage in your browser. Blocking essential cookies can prevent sign-in and connection flows; clearing browser storage does not necessarily revoke a server session or delete stored account data. Use Sign out to revoke your current Yevr session and Disconnect to remove the live Workspace credentials.

We have not added a consent banner for essential storage alone. Before adding nonessential analytics, advertising, or tracking, we will revisit the inventory, this notice, and jurisdiction-appropriate consent controls. Contact [email protected] with questions or requests.