Cookie Policy

Cookies are small text files that a website places on your device (computer, phone, tablet) when you visit. They are stored in your browser and sent back to the originating website on subsequent visits, or to another website that recognises the cookie.

Beyond traditional cookies, this policy also covers similar technologies that perform equivalent functions: localStorage, sessionStorage, pixel tags (also called tracking pixels or web beacons), and browser fingerprinting signals where applicable.

Types by lifespan

Session cookies exist only for the duration of your browsing session and are deleted when you close your browser. Persistent cookies remain on your device for a defined period (or until you delete them) and are reactivated when you return to the same site.

Types by origin

First-party cookies are set by OCXLY directly. Third-party cookies are set by external services (such as Google Analytics) embedded in our pages. We have no direct control over the data those third parties collect via their own cookies — their privacy policies govern that collection.

The data controller responsible for cookies on ocxly.com and all OCXLY subdomain properties is:

OCXLY (Object Core eXperience LaboratorY)
Kochi, Kerala, India — 682 028
Email: [email protected]
Phone / WhatsApp: +1 (646) 238 5077

For EU/UK residents, OCXLY acts as the sole data controller for cookie-related processing on this website. We do not currently have a designated EU representative under Article 27 GDPR; EU/EEA residents may contact us directly at the email above.

We operate four cookie categories. You control three of them. The fourth (Strictly Necessary) cannot be turned off without breaking core site functionality.

01 — Strictly Necessary

These are essential for the website to function. They enable core features such as security, consent preference storage, and navigation. Without them, services you have asked for cannot be provided. No consent is required under GDPR Recital 25 or PECR Regulation 6(4) for these cookies.

They include our consent management record (ocxly_consent_v1), session continuity tokens, and security headers.

02 — Analytics & Performance

We use Google Analytics 4 (property G-G0YYSQ6Y40) loaded via Google Tag Manager (GTM-K2DJNCCC) to understand how visitors interact with our site — which pages are viewed, how long sessions last, and where visitors come from. All data is aggregated and anonymised before we see it; no personally identifiable information is stored in our Analytics account.

Analytics cookies are only deployed after you grant consent. If you decline, Google Analytics is not loaded and no data is sent.

03 — Functional

Functional cookies remember your preferences to personalise your experience on return visits. On OCXLY, this includes your Calm Mode setting (ocxly_calm_v1) — a reduced-motion, lower-contrast reading mode designed for neurodiverse visitors. If you have enabled Calm Mode, a functional cookie preserves that choice across sessions.

Note: Calm Mode preference is currently stored in localStorage, not a traditional cookie file, but it is treated as a functional cookie under this policy because it serves the same purpose.

04 — Marketing & Personalisation

Marketing cookies are used to build a profile of your interests and show you relevant content or advertising. On OCXLY, this category is reserved for future use (e.g. if we activate Google Ads remarketing or a social media pixel). Currently, no marketing cookies are actively deployed on this site. If and when we activate this category, this policy will be updated and a new consent prompt will be shown.

For California residents: disabling this category constitutes your opt-out of the "sale or sharing" of personal information as defined under the CCPA/CPRA.

The following table lists every cookie and local storage key currently active on OCXLY properties. We audit this list whenever we update third-party integrations.

First-party cookies & storage

Third-party cookies (Google Tag Manager / GA4)

All Google Analytics cookies are only loaded after you grant Analytics & Performance consent. If you reject or do not respond, the GTM container still loads but fires no GA4 tags.

We use the following third-party services that may process data through cookies or similar technologies:

Google Analytics 4 & Google Tag Manager

Property: G-G0YYSQ6Y40 · Container: GTM-K2DJNCCC

Operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google may transfer data to servers in the United States and other countries. For EU/EEA users, this transfer relies on Standard Contractual Clauses (SCCs). Google's privacy policy is available at policies.google.com/privacy.

You can opt out of Google Analytics across all websites at tools.google.com/dlpage/gaoptout.

Web fonts

The Fraunces, Geist, Geist Mono, and Atkinson Hyperlegible typefaces are self-hosted on this domain. No third party receives your IP address or any request data when fonts are loaded.

cdnjs (Cloudflare)

We load the QRCode.js library from cdnjs.cloudflare.com on the Contact page. Cloudflare may log your IP address for security and performance purposes. No cookies are set by this CDN request. See Cloudflare Privacy Policy.

Future integrations

If we add new third-party services (e.g. Hotjar, Meta Pixel, LinkedIn Insight Tag), this section will be updated and a new consent prompt displayed to all visitors before those services are activated.

Under GDPR & UK GDPR

Strictly Necessary cookies — Legitimate Interest (Article 6(1)(f) GDPR); Recital 25 exemption under ePrivacy Directive; Regulation 6(4) under PECR. These are processed without consent because they are essential to delivering the service you have requested.

All other categories — Consent (Article 6(1)(a) GDPR). You provide freely given, specific, informed, and unambiguous consent through the cookie banner before any non-essential cookie is placed. You can withdraw consent at any time (see § 07).

Under PECR (UK)

We rely on the Regulation 6(4) "strictly necessary" exemption for essential cookies. All other cookies require prior informed consent under Regulation 6(1). Our consent mechanism meets the ICO standard: consent is obtained before placement, is granular per category, is as easy to withdraw as to give, and is recorded.

Under CCPA/CPRA (California)

We treat Marketing & Personalisation cookies as involving the "sharing" of personal information. Disabling this category in the consent panel is equivalent to exercising your "Do Not Sell or Share" right under CCPA § 1798.120. We do not sell personal information.

Under India IT Rules 2021 & DPDPA 2023

Under the Digital Personal Data Protection Act 2023, we collect and process personal data (including device identifiers via cookies) only to the extent necessary for the stated purposes and only with your free, informed, specific, and unconditional consent where required. You have the right to withdraw consent and to have your data erased (see § 08).

Manage preferences on this site

You can review or change your cookie choices at any time using the button below — the same preference panel shown on your first visit will reopen, and your new choices take effect immediately.

Browser-level controls

Every modern browser allows you to view, block, and delete cookies independently of any consent tool. Instructions for the most common browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Note: blocking all cookies will prevent our consent record from being stored, which means the cookie banner will reappear on every visit.

Opt out of Google Analytics

Install the Google Analytics Opt-out Browser Add-on to prevent your data being used by Google Analytics across all websites, independent of our consent panel.

Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. There is currently no legally recognised standard for how websites must respond to DNT. We honour your in-site consent choices as the definitive signal and do not separately interpret DNT headers.

Local storage

Our consent record and Calm Mode preference are stored in your browser's localStorage. To clear these, use your browser's developer tools (Application → Local Storage → delete ocxly_consent_v1 and/or ocxly_calm_v1) or clear all site data for ocxly.com in your browser settings.

EU / EEA residents (GDPR)

You have the right to: access the personal data we hold about you (Article 15); rectification (Article 16); erasure (Article 17); restriction of processing (Article 18); data portability (Article 20); and to object to processing (Article 21). You also have the right to lodge a complaint with your national supervisory authority.

UK residents (UK GDPR · PECR)

You have equivalent rights under UK GDPR and may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

California residents (CCPA / CPRA)

You have the right to know what personal information is collected, the right to delete, the right to opt out of sale or sharing, the right to correct, and the right to non-discrimination for exercising your privacy rights. To exercise these rights, email [email protected] with the subject line "CCPA Request".

India residents (DPDPA 2023)

As a data principal under the Digital Personal Data Protection Act 2023, you have the right to: obtain information about processing; correction and erasure of your personal data; grievance redressal (within 30 days per our Grievance Officer process); and nomination. Contact our Grievance Officer at [email protected].

To exercise any of the rights above, email [email protected]. We will respond within 30 days (or sooner where required by law).

Your consent choices are stored in your browser's localStorage under the key ocxly_consent_v1 as a JSON object. An example of the data stored:

Example stored value

{"analytics": true, "functional": true, "marketing": false, "ts": 1737000000000}

The ts field is a Unix timestamp (milliseconds) recording when consent was given. This record stays on your device — it is never transmitted to our servers. We cannot see your individual consent record; we only know at the analytics level whether GA4 tags are firing (which requires consent).

GDPR Article 7(1) requires us to be able to demonstrate that consent was given. We satisfy this through the timestamp and category record stored locally, supplemented by GTM consent mode signals that confirm to Google which categories were granted before any tag fires.

We do not retain cookie data on our own servers — all cookie and localStorage data resides on your device. Retention periods for individual cookies are listed in the Full Cookie Inventory (§ 04).

Google Analytics aggregated, anonymised data may be retained in our GA4 property for up to 14 months (our current data retention setting). This data cannot be used to identify individual users.

To delete all OCXLY-related data from your device: clear cookies and site data for ocxly.com in your browser settings. This will also clear your consent record, so the cookie banner will reappear on your next visit.

Our website is not directed at children under the age of 13, or under 16 in EU/EEA jurisdictions where Member States have raised the digital consent age. We do not knowingly place non-essential cookies on the devices of children. If we become aware that a child has provided personal data without appropriate parental consent, we will delete it promptly. Please contact [email protected] if you believe this has occurred.

We review this Cookie Policy whenever we add or remove third-party integrations, or when applicable law changes. The "Last Reviewed" date at the top of this page reflects the most recent review. Material changes — such as adding a new cookie category or a new third-party data processor — will trigger a new consent prompt for all visitors so you have the opportunity to review and re-confirm your choices.

Minor changes (such as correcting a cookie retention period or updating a third-party link) will be reflected in the revised policy without a new consent prompt, but the review date will be updated.

For any questions about this Cookie Policy, to exercise your data rights, or to withdraw consent:

OCXLY — Data Controller
Kochi, Kerala, India — 682 028
Email: [email protected]
Phone / WhatsApp: +1 (646) 238 5077

We aim to respond to all privacy-related enquiries within 30 days, and faster where legally required.

Document: cookie-policy.html · Version 1.0 · Effective 15 January 2026
Controller: OCXLY, Kochi, India · [email protected]
Jurisdiction: Global · GDPR · UK GDPR · PECR · CCPA/CPRA · IT Rules 2021 · DPDPA 2023