Legal
Cookies
Draft — illustrative only. This page describes our intent, not a binding agreement. For the version currently in force, contact hello@orphl.ink.
Last updated: 16 September 2026
This marketing site sets no cookies.
www.orphl.ink (the page you're reading) uses no cookies, fingerprinting, or third-party tags. It stores a single localStorage entry, nuxt-color-mode, holding the colour theme so the page renders in the right mode; it stays in your browser and is never sent to us. If you join the waitlist, the email you type is sent to us once, when you submit the form — see the privacy policy.
Cookies on the product
The product domains (orphl.ink for short-link traffic and app.orphl.ink for the dashboard) set a small number of functional cookies (no advertising or tracking cookies). Each is listed below.
Short-link cookies (orphl.ink/<slug>)
| Name | Purpose | Lifetime | Set when |
|---|---|---|---|
| orphlink_consent | Records the visitor's response to the GDPR consent prompt for a workspace that has consent enabled. Values: granted or declined. Declined visitors still redirect; no click event is recorded, only an anonymous counter increments. | 30 days | Only when the workspace owner has enabled the GDPR consent gate on the workspace. |
| orphlink_pw_<slug> | Marks a visitor as having entered the correct password for a password-protected link, so they don't have to re-enter it on every click. The cookie value is a signed HMAC envelope bound to that link, not the password itself. | 24 hours | Only after the visitor enters the correct password for that specific link. |
Both cookies are HttpOnly, Secure, and SameSite=Lax. Neither is used for advertising, cross-site tracking, or analytics.
Dashboard cookies (app.orphl.ink)
| Name | Purpose | Lifetime |
|---|---|---|
| refresh_token | Keeps you signed in: exchanged for a fresh short-lived access token, which is held in memory rather than in a cookie. Replaced on every use. HttpOnly, Secure, SameSite=Strict. | Cookie kept up to 30 days; the token inside expires after 7 days |
| active_workspace | Remembers which workspace you last selected. SameSite=Lax. | 30 days |
Both cookies are needed for the dashboard to keep you signed in and in the right workspace. We do not use third-party analytics, ad cookies, or session-replay tools on the dashboard.
GDPR consent flow
Workspace owners can enable a GDPR consent prompt that appears the first time a visitor follows one of that workspace's short links. The prompt is plain-language and offers two clear choices — Accept (records a click event) or Continue without tracking (visitor still reaches the destination, no click event is recorded, only an anonymous counter is incremented). The choice is remembered for 30 days via the orphlink_consent cookie. See the privacy policy for what we collect when consent is granted.
Contact
Questions about a cookie you've spotted: hello@orphl.ink.