Legal
Cookies
Draft — illustrative only. This page describes our intent, not a binding agreement. For the version currently in force, contact hello@orphl.ink.
Last updated: 17 May 2026
This marketing site sets no cookies.
www.orphl.ink (the page you're reading) does not use cookies, local storage, fingerprinting, or third-party tags. There is nothing to consent to here.
Cookies on the product
The product domains (orphl.ink for short-link traffic and app.orphl.ink for the dashboard) set a small number of strictly necessary cookies. Each is listed below.
Short-link cookies (orphl.ink/<slug>)
| Name | Purpose | Lifetime | Set when |
|---|---|---|---|
| orphlink_consent | Records the visitor's response to the GDPR consent prompt for a workspace that has consent enabled. Values: granted or declined. Declined visitors still redirect, but no click is recorded. | 30 days | Only when the workspace owner has enabled the GDPR consent gate on the workspace. |
| orphlink_pw_<slug> | Marks a visitor as having entered the correct password for a password-protected link, so they don't have to re-enter it on every click. The cookie value is an HMAC, not the password itself. | Session (browser close) | Only after the visitor enters the correct password for that specific link. |
Both cookies are SameSite=Lax and Secure. Neither is used for advertising, cross-site tracking, or analytics.
Dashboard cookies (app.orphl.ink)
| Name | Purpose | Lifetime |
|---|---|---|
| orphlink_session | Short-lived JWT access token; identifies the signed-in user. httpOnly, Secure, SameSite=Lax. | 15 minutes |
| orphlink_refresh | Rotated refresh token used to mint new access tokens without re-entering credentials. httpOnly, Secure, SameSite=Lax. | 7 days (rotated on use) |
Both session cookies are strictly necessary to keep you signed in. We do not use third-party analytics, ad cookies, or session-replay tools on the dashboard.
GDPR consent flow
Workspace owners can enable a GDPR consent prompt that appears the first time a visitor follows one of that workspace's short links. The prompt is plain-language and offers two clear choices — Accept (records a click event) or Continue without tracking (visitor still reaches the destination, no click is recorded, only an anonymous counter is incremented). The choice is remembered for 30 days via the orphlink_consent cookie. See the privacy policy for what we collect when consent is granted.
Contact
Questions about a cookie you've spotted: hello@orphl.ink.