Document status: beta draft, revised 2026-11-05. The team has not yet supplied the legal operator's registered name, correspondence address, country or data-controller identity. These documents describe current operations but are not a completed legal disclosure or a claim of commercial readiness. Contact support@unbound-me.com for clarification before purchasing or submitting personal data. Statutory rights remain unaffected.
Essential session cookies
The customer session cookie ub_session authenticates the account and expires after seven days. The administrator cookie router_session expires after eight hours. Session cookies are HttpOnly and SameSite=Strict; production sets Secure so they are sent over HTTPS. Signing out clears the relevant cookie and invalidates access. The service stores token hashes, rather than the cookie's raw secret, for customer sessions.
Blocking session cookies prevents sign-in. Public model information and documents remain readable without signing in. Cookies are not used to store the customer balance or to authorize wallet withdrawals without server checks.
Interface storage
The installable web app registers a service worker and keeps one static offline information page in browser Cache Storage. It does not cache account pages, API responses, balances, credentials or payments. Online navigation always uses the network. App icons and browser-managed installation data may be retained by your device. You can remove the app and clear this site's stored data in browser settings.
The landing headline animation replays on each page load without storing a completion flag. The separate sky loading effect may use sessionStorage to remember its introduction within the current tab. Other local interface preferences may preserve navigation or presentation state; the server remains authoritative for account access, permissions and funds. Browser developer tools let you inspect or clear site storage. Clearing storage may reset preferences or sign you out; it does not delete the server-side account.
Edge and external services
Cloudflare may process connection metadata and use security/challenge cookies depending on the zone's active settings. These are controlled by the edge configuration, not a locally invented analytics consent banner. The operator must confirm and maintain the actual cookie inventory as those settings change.
There is currently no configured advertising tracker or optional analytics integration. Configured Google and GitHub sign-in buttons redirect to the selected provider for authentication. We request identity and verified email access only, not repository or Google Drive access. We retain a provider-specific account identifier to recognize connected accounts. Access tokens and ID tokens are used during verification and are not persisted. Short-lived, browser-bound OAuth state is encrypted on the server and expires after ten minutes; a separate HttpOnly, SameSite=Lax correlation cookie is used for the callback. Existing accounts must explicitly connect a provider after signing in and confirming their password and any enabled authenticator. Matching email addresses alone do not merge accounts. Unconfigured buttons do not start OAuth. We will not describe a future optional tracker as essential: if one is introduced, the notice and any legally required consent controls must be updated before activation.
Controls and questions
You can remove this site's cookies in your browser settings. This affects the browser, not server-side ledger records or public-chain data. For privacy or account deletion requests, use support@unbound-me.com and read the privacy policy.
