Cookie Policy
Last updated: 24 April 2026
This policy explains what cookies and similar browser-storage mechanisms Udyamik uses, why we use them, and how you can control them. It should be read alongside our Privacy Policy.
What are cookies?
Cookies are small text files that a website stores in your browser. They are how websites “remember” that you are logged in across page loads, along with a few other housekeeping tasks. Related mechanisms include localStorage, sessionStorage, and IndexedDB — this policy covers all of them collectively.
On this marketing site (udyamik.com)
The marketing site sets no cookies at all. It is fully static — Astro-generated HTML and CSS served from a Caddy file server — with no user accounts, no analytics tags, and no embedded third-party widgets that would set cookies on your behalf. You can verify this via your browser's developer tools (DevTools → Application → Cookies).
On the product (app.udyamik.com)
When you sign in to the application, we set the following strictly-necessary items in your browser. None of them are tracked, advertised against, or sold.
| Name | Type | Purpose | Duration |
|---|---|---|---|
udyamik.session | localStorage | Holds your active JWT SESSION token so you stay signed in across tabs and refreshes. Expires after 15 minutes of inactivity. | Session (cleared on sign-out) |
udyamik.refresh | localStorage | Holds a device-bound refresh token used to transparently renew your SESSION without requiring a fresh OTP. Rotated on every use. | 7 days |
udyamik.deviceId | localStorage | A client-generated UUID identifying this browser to the server for device-bound PIN re-auth. Unique per browser; no personal information. | Persistent (cleared on sign-out + device revoke) |
udyamik.ui.prefs | localStorage | UI preferences (sidebar collapsed state, dark-mode preference). Local to your browser; never sent to the server. | Persistent |
We deliberately avoid HTTP cookies for session state — the JWT bearer token is sent explicitly in the Authorization header on each request. This means CSRF is not a concern on the data-plane; there is nothing a cross-origin request could cause the browser to attach automatically.
Analytics
We use Plausible Analytics, self-hosted on our own infrastructure. Plausible is an open-source, privacy-first analytics engine that:
- Sets no cookies.
- Does not use fingerprinting or cross-site tracking.
- Does not collect personally identifying information.
- Stores only aggregate page-view counts, anonymised user-agent strings and referrers.
Because Plausible is cookie-free and anonymous, we are not required to show a consent banner under the DPDP Act or the ePrivacy Directive. We have documented this decision at plausible.io/privacy-focused-web-analytics. No consent action is required from you.
Third-party cookies
Neither the marketing site nor the app embeds third-party widgets (Facebook Pixel, Google Analytics, LinkedIn Insight Tag, Intercom, Drift, HubSpot, etc.). We do not load any script that would set a cookie on your browser on behalf of a third party.
The only exception is when you actively choose to pay a fee through Razorpay from inside the app — at that point, Razorpay's checkout iframe handles your card / UPI / NetBanking input, and Razorpay may set cookies within its own razorpay.com context per its privacy policy. We never see these cookies; they live on the Razorpay domain.
How to control cookies
You can clear or block cookies and local storage through your browser's privacy settings:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Preferences → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Cookies and website data
- Edge: Settings → Cookies and site permissions
Blocking our strictly-necessary localStorage items will sign you out and break features like “stay signed in”, but will not prevent you from using the site once you sign in again.
Changes to this policy
If we add or remove cookies, or introduce a third-party integration that sets one, we will update this page and the “Last updated” date at the top. Material additions will also be notified via email to account holders at least 15 days before the change.
Contact
Questions about cookies and browser storage: privacy@udyamik.com.