Cookie Policy

Draft: pending legal review. Published for transparency while Alchemis is in pre-launch. It reflects how the service works today, but it hasn't yet been reviewed by a lawyer and may change before we open to makers.

Effective date: 30 August 2026
Service: Alchemis (alchemis.net and alchemis.fi — the same service on either address), operated by RM Systems (Renno Mihailov, private trader), Espoo, Finland (Business ID 2424442-1; not VAT-registered — small business exemption, Finnish VAT Act §3) ("we", "us").

This explains the cookies and browser storage Alchemis uses. Alchemis uses only what's needed to run the service — there are no advertising or third-party tracking cookies, and no third-party analytics or tracking scripts. The only measurement we run is our own self-hosted, cookieless analytics (see section 3).

1. Cookies we set (strictly necessary)

These are set by our own server during sign-in and are essential for authentication and security:

Cookie	Purpose	Type	Retention
`.AspNetCore.Identity.Application`	Keeps you signed in to the server-rendered sign-in/account pages	Strictly necessary	Session / sign-in lifetime
`.AspNetCore.Identity.TwoFactorRememberMe`	Remembers a trusted device so you can skip the 2FA step (only if you tick "remember this device")	Strictly necessary (security)	30 days
`.AspNetCore.Antiforgery.{hash}`	Protects sign-in/account forms against cross-site request forgery (paired with the hidden `__RequestVerificationToken` field inside each form)	Strictly necessary	Session
`.AspNetCore.Identity.TwoFactorUserId`	Carries you between the password step and the code step during a two-factor sign-in	Strictly necessary	Session
`.AspNetCore.Mvc.CookieTempDataProvider`	Carries one-time status messages between pages during sign-in and password flows (e.g. "password changed")	Strictly necessary	Session
OpenIddict / OIDC sign-in cookies	Used during the authentication/authorisation flow	Strictly necessary	Session

Because these are strictly necessary to provide a service you've requested (signing in), they do not require prior consent under the ePrivacy rules — but we disclose them here for transparency.

2. Browser storage (not cookies)

The web app — and, for the language choice, this public website — keeps a small amount of state in your browser's localStorage / sessionStorage. This stays on your device and is not sent to advertisers or third parties:

Key	Purpose	Storage
Authentication tokens (via the `angular-oauth2-oidc` library)	Keep you signed in to the app; cleared when the tab/session ends	`sessionStorage`
`currentWorkspaceId`	Remembers which workspace you last had open	`localStorage`
`alchemis-theme`	Your light/dark choice — set when you pick a theme in the app	`localStorage`
`alchemis-lang`, `alchemis-lang-hint`	Your language choice, and whether you dismissed the language suggestion — on this website it is set only when you use the language switcher; the app also keeps it in step with the language saved on your account	`localStorage`
`alchemis-nav-groups-v2`, `alchemis-nav-pinned`	Which navigation groups you keep open, and whether the navigation is pinned	`localStorage`
`alchemis-show-upgrade-prompts`	Your preference to show/hide upgrade nudges	`localStorage`
`recipe-builder-draft-*`	A local draft of a recipe you haven't saved yet	`localStorage`
`trial_banner_dismissed:{account-id}`	Remembers that you dismissed the trial reminder	`localStorage`
`pendingInviteToken`, `pendingShareImport`	Let a workspace invitation or a shared-recipe import resume after you sign in	`localStorage`
First-run tour / onboarding flags, checkout-funnel flag	Remember that you've seen the tour / are mid-checkout so we don't repeat it	`local`/`sessionStorage`

Platform administrators additionally get temporary imp_* sessionStorage keys during an audited support session; these never appear for makers.

3. Third-party connections

Our pages make no third-party connections to render: all webfonts are self-hosted on our own infrastructure, and no third-party scripts, trackers, or CDNs are loaded. Simply browsing sends your IP address to no one but us. The one script beyond the page itself is our own self-hosted, cookieless analytics (Umami), which loads from analytics.alchemis.net — our own infrastructure — and counts visits in aggregate without cookies or behavioural tracking.

4. Managing cookies

You can clear or block cookies in your browser settings, but blocking the strictly-necessary cookies above will prevent you from signing in. Clearing browser storage will sign you out and reset local preferences.

5. Contact

Questions: support@alchemis.net.