1. Scope and controller
This policy covers xMath and its link to the single ONMAKE sign-in. Controller: ONMAKE S.r.l., with address and contact details in document 03; requests to info@onmake.it. Cookies, local storage and cache have different functions but may all write to or read from the device; technical necessity is assessed against the service requested, not the name given to the tool.
xMath's code contains no analytics, advertising pixels or profiling SDKs. The public website, account area and checkout may use other tools, described in their own interfaces with separate preference management.
2. Cookies
onmake-auth: the ONMAKE account session, shared among the apps on the .onmake.it domain. It lasts thirty days, is Secure and SameSite=Lax; because the page must read it, it is not HttpOnly. It may be split into several numbered cookies to respect the size limit. It serves a service requested by the user.
onmake-lingua: language preference (it, en, fr, de, es) set by the ONMAKE header when the user chooses a language; domain .onmake.it, one-year lifetime (31,536,000 seconds), SameSite=Lax, Secure.
These cookies are not profiling tools and do not contain calculation content. Refusing or deleting them may interrupt access or lose the chosen language.
3. Local storage
The browser's local storage keeps: xmath_tema_sfondo (background theme); xmath_quaderno (the app's notebook: requests not understood, rephrasings and solutions found by the engine, up to two hundred entries); xmath_ai_provider, xmath_ai_model and xmath_ai_key (provider, model and API key chosen in the AI assistant; the key is kept in clear text). The ONMAKE access guard may also copy once into app.onmake.it's storage the data the user saved on www.onmake.it and records the key onmake-trasloco-dati. xMath's code uses neither IndexedDB nor sessionStorage.
These entries may contain expressions entered by the user and, in the case of the key, a secret: they remain until deleted by the user, the browser or an app function. Storage serves the requested function; any storage for statistics, advertising or other purposes requires assessment and, where applicable, prior consent.
5. Third parties and consent
The optional functions of the AI Assistant tab and the reading of an equation from an image or PDF connect the browser to third-party services (Pollinations, Google, Groq, Mistral, OpenRouter, esm.run): these are not cookies but connections that communicate at least the IP address and ordinary technical data and the content sent (document 03). Stripe cookies are governed by the checkout. On the public website, any non-necessary analytics stay inactive until the user makes a valid choice.
6. Changes and rights
New non-necessary tools are not introduced merely by accepting updated terms: changes are communicated before activation and consent is requested where due. Document 03 applies to privacy rights and recipients.