Cookie policy and browser storage notice

1. Scope and controller

This policy covers xTdC and its link to the single ONMAKE sign-in. Controller: ONMAKE S.r.l., with address and contact details in document 03; requests to info@onmake.it. Cookies, local storage, sessionStorage and cache have different functions but may all write to or read from the device; technical necessity is assessed against the service requested, not the name given to the tool.

xTdC's code contains no analytics, advertising pixels or profiling SDKs. The public website, account area and checkout may use other tools, described in their own interfaces with separate preference management.

2. Cookies

onmake-auth: the ONMAKE account session, shared among the apps on the .onmake.it domain. It lasts thirty days, is Secure and SameSite=Lax; because the page must read it, it is not HttpOnly. It may be split into several numbered cookies to respect the size limit. It serves a service requested by the user.

onmake-lingua: language preference (it, en, fr, de, es) set by the ONMAKE header when the user chooses a language; domain .onmake.it, one-year lifetime (31,536,000 seconds), SameSite=Lax, Secure. xTdC reads it to show the interface in the chosen language.

These cookies are not profiling tools and do not contain calculation data. Refusing or deleting them may interrupt access or lose the chosen language.

3. Local storage and calculation data

Projects, module states and transfers between modules are kept in the browser's local storage and sessionStorage under keys starting with XTdC. (for example XTdC.xAcciaio.project.v1, XTdC.xCA.projects.v1, XTdC.xSchema2D.model.v3, XTdC.xNeveVento.state.v1, XTdC.relazione.xAcciaio.v1, the transfers XTdC.xAnalisi.transfer.v1 and XTdC.xStatica.trave.transfer.v1) and under the key xcov_state_v1. Display preferences (zoom, level of detail, home view, items shown, professional or teaching mode) use keys starting with xtdc-. IndexedDB is not used.

These entries may contain personal data (clients, locations, designers entered on cover sheets) and have no expiry: they remain until deleted by the user, the browser or an app function. sessionStorage lasts as long as the tab. Storage serves the requested function; any storage for statistics, advertising or other purposes requires assessment and, where applicable, prior consent.

4. User control and shared devices

Users can delete cookies and site data in browser settings. Before clearing local storage they must save the projects they want to keep (JSON, CSV, XLSX, .xcad files): some copies exist only in the browser. Logging out or deleting the account does not prove that local copies have been deleted.

On shared devices use a protected personal profile and clear site data afterwards. Private browsing may reduce persistence but may lose projects on closing.

5. Third parties and consent

When the print or report window of some modules is opened, the browser connects to cdn.jsdelivr.net to load the KaTeX stylesheet: this is not a cookie but a connection to a third-party service that may receive ordinary technical connection data (document 03). Stripe cookies are governed by the checkout. On the public website, any non-necessary analytics stay inactive until the user makes a valid choice.

6. Changes and rights

New non-necessary tools are not introduced merely by accepting updated terms: changes are communicated before activation and consent is requested where due. Document 03 applies to privacy rights and recipients.