Viora Cookie and Device Storage Policy
Version 1.2 · Effective date: 22 October 2026
1. Scope and contact
This policy is issued by Warif albariah Establishment (مؤسسة وريف البرية), a sole establishment registered in the Commercial Register of the Kingdom of Saudi Arabia under number 7055443712. Viora is a brand the establishment uses; in this policy, “Viora”, “we” and “us” mean the establishment. Contact support@v-ora.co about this policy.
This policy covers cookies and similar storage on v-ora.co, the shared-report service at report.v-ora.co, and Wasim's local application storage. Other products may have additional notices. Read it with our Privacy Policy, which explains personal-data purposes, recipients, overseas processing, server retention and your rights.
A cookie is a small browser record that can accompany later requests. Local storage normally remains until removed; session storage is associated with a tab or application window. Browser restoration can preserve session state. These technologies can contain personal data even when they are not called cookies or stay on your device.
2. What is necessary and what is optional
“Necessary” means needed for the particular function, not that Saudi law requires a named cookie. Visiting public pages does not require an account session. Using an account requires authentication; protected forms may also require a security check. We explain the effect of blocking them below.
| Purpose | How we treat it |
|---|---|
| Account authentication and navigation | Used to provide the account or navigation function you request. Personal-data processing necessary to implement our agreement relies on that agreement. |
| Protection against abuse | Used where needed to protect the service, under a valid legal basis. Legitimate-interest processing is limited to necessary, proportionate uses that do not prejudice your rights and do not involve sensitive personal data. A provider's separate purposes require their own assessment. |
| Appearance you pick | Necessary for the function you request. When you pick the light or dark appearance with the website's buttons, v-ora.co remembers it on this browser so the next page opens in it; nothing is saved until you pick. The website's language is part of the page address (/ar or /en) and is not stored. On report.v-ora.co and in Wasim, a preference is saved only when you choose it with that service's control (sections 3 and 6). It is not used for analytics or marketing. |
| Optional analytics, advertising or tracking | Not used. Before introducing any of these purposes, we will explain them and obtain your separate prior opt-in. Refusing them will not prevent unrelated services from working. |
We do not ask you to accept all storage as a condition of browsing. Where personal data is involved, each purpose needs a lawful basis. Accepting the terms, scrolling or continuing to browse is not consent to optional tracking.
On v-ora.co, a notice at the bottom of the page names the storage the site uses, with OK and Settings. Settings shows one category, Necessary (sign-in, security, navigation state, the appearance you pick and the record that you have seen the notice), shown as “Always active”, because the functions you request cannot work without it; it cannot be switched off. There is no optional category. Closing, ignoring or scrolling past the notice is not consent to anything optional. The notice does not appear on report.v-ora.co or in Wasim; sections 3 and 6 explain their storage.
3. Website and shared-report storage
| Item | What it does | Duration and controls |
|---|---|---|
Website sign-in (Necessary), local storage, sb-<project>-auth-token | Supabase keeps authentication tokens and account details needed for your signed-in session. Created through sign-in or an authentication link, not merely by reading a public page. | Persists across visits. Successful sign-out removes the local session; clearing this site's data also removes it. Session validity depends on authentication settings and automatic refresh, so a short access-token lifetime is not the lifetime of this stored entry. |
Cookie notice (Necessary), local storage, viora-consent | Records that you pressed OK on the cookie notice, so that it is not shown on every page: the date and time, the page language, and the version of this policy and of the record. It contains no name, email address or IP address and is not sent to us. | Kept on this browser. After 12 months, or when a change to this policy must be shown again, the notice returns and a new record replaces it. Clearing this site's data removes it and the notice returns. |
Website appearance (Necessary), local storage, viora-theme | Remembers whether you chose the light or dark appearance. Saved only when you choose an appearance; otherwise pages open in the light appearance. It is not an advertising identifier. | No fixed automatic expiry. Replaced when you choose again; removed when you clear this site's data. |
Navigation state (Necessary), session storage, including sveltekit:scroll and sveltekit:snapshot where created | Helps navigation restore page position or application state. It is not used for advertising or independent visitor profiling. | Normally lasts for the tab's session; browser session restoration may retain it. Clear site data to remove it. |
Shared-report preferences, local storage on report.v-ora.co, dl.lang and dl.theme | Remembers language and appearance when you choose them. The selected language also accompanies report-opening requests for localised responses. | No fixed automatic expiry. Change the setting or clear data for the report site separately. |
The authentication software may briefly create and remove a local-storage test entry to check whether storage works. Browsers also cache static resources such as fonts and public map assets; some shared-report assets have cache instructions of up to one year, subject to browser eviction or clearing. Report-data responses instruct browsers not to store them in the HTTP cache; viewers can still save or copy what they see.
These are browser records, not the retention periods for copies on our servers. Signing out or clearing them does not delete orders, cloud projects or shared reports. Their treatment is explained in the Privacy Policy and product terms.
4. Cloudflare security processing
Our sign-in, sign-up, password-reset and contact forms are built to use Cloudflare Turnstile to distinguish legitimate use from automated abuse. It is switched off when this version takes effect: its component is not loaded and nothing is sent to it. When we switch it on, it will receive technical signals such as IP address, browser information and site origin; our contact-form check will also send the requesting IP address to Cloudflare; and this processing can start when the component loads, before you submit the form. We will update this policy when we switch it on.
Cloudflare acts for us in providing the check and, under its Turnstile privacy terms, also determines its own processing to improve bot detection. That separate purpose is not made necessary merely by calling the service a security check. The Privacy Policy explains overseas processing and safeguards.
Security cookies depend on the protection encountered and the enabled service. Turnstile normally returns a short-lived verification token; optional pre-clearance can also place a cookie on the site. We therefore do not promise that Turnstile never uses cookies or that all its storage is confined to its own frame.
| Security item, when used | Purpose | Lifetime |
|---|---|---|
__cf_bm | Distinguishes automated traffic as part of Cloudflare's bot protection | Cloudflare specifies 30 minutes of inactivity. |
cf_clearance | Records that a security challenge has been passed | As long as our Cloudflare Challenge Passage setting allows: Cloudflare's default is 30 minutes, and it cannot be set longer than one year. |
_cfuvid and other applicable challenge/rate-limit storage | Helps protection distinguish requests and apply checks | _cfuvid is set only when a Cloudflare rate-limiting rule that tells apart visitors sharing one IP address is in use. Cloudflare's challenge pages may also set cf_chl_rc_i, cf_chl_rc_ni and cf_chl_rc_m, which Cloudflare uses internally to identify production issues. Cloudflare does not publish a fixed lifetime for these items; see its cookie documentation below. |
Cloudflare's cookie documentation gives further information. A cookie's expiry does not establish when related server records are deleted. Blocking a required check can prevent the protected form from working; you may contact support@v-ora.co if you cannot use it.
5. Measurement, reports and third-party pages
We do not use browser analytics, advertising pixels or cross-site tracking. Cloudflare still processes network requests and operational traffic information to deliver and protect services. Those server records are covered by the Privacy Policy; they do not disappear because a browser has no analytics cookie.
Opening a shared report increases its successful-open count, which the sender can see. This is a count of opens, not unique people, and does not use a visitor-identification cookie in the report service. Cloudflare still receives the network request. Wasim's identifiable team activity reports are a separate service feature explained in the Privacy Policy; a cookie choice does not turn that feature off.
Payment pages operated by our payment provider may use their own security or payment-session storage. The provider's notice applies to processing it determines; our Privacy Policy names the provider, and its own page identifies it when you pay. Our controls cannot erase another provider's independently controlled storage. Optional marketing or tracking by a provider is not automatically authorised by your decision to pay.
6. What Wasim stores locally
Wasim's browser-based interface stores appearance and language preferences, including wasim.theme, wasim.palette, wasim.lang and wasim.species-lang. These are local caches of application settings. Changing a setting replaces the relevant value; it does not necessarily remove the storage entry. There is no fixed automatic expiry for these caches.
Temporary session storage includes download notices (wasim.download.announcements) and launch licence-status state (wasim.launch.band). Download notices are consumed when shown or treated as stale after about a minute; residual session entries may remain until cleared or the window's storage session ends. They are not advertising identifiers.
Wasim also stores settings, recent-project information and project files separately from these interface caches. Your email address and a sign-in token are kept in Windows Credential Manager, together with your account password if you tick “Remember my password”. Signing out removes the sign-in token but keeps the email address, any remembered password, local projects and exports. To remove a remembered password, sign in with “Remember my password” unticked; contact support if you need help removing other locally retained information. Uninstalling an application is not a promise that every local copy is erased.
Local storage does not mean Wasim is offline-only: licensing, software delivery, selected cloud features and shared reports make the connections explained in the Privacy Policy and Wasim Terms. A website cookie choice does not change those product settings or delete project files.
7. Your controls
- Sign out on shared computers. Closing a browser tab alone may leave the website signed in.
- Change appearance or language using the relevant website, report or app control. Public pages remain available without personalised appearance settings.
- Clear or block site data in your browser settings. Website and shared-report storage belong to different origins, so clear each relevant site. Removing authentication storage signs you out; blocking required storage may prevent account functions. Browser restoration and provider-controlled storage may need separate attention.
- See the storage category at any time through Cookie settings, linked in the footer of every page and in the site menu on v-ora.co; the notice also returns after 12 months. Any future optional category, such as analytics, will be added there switched off, with its own choice, before it is used. Closing or ignoring the notice leaves optional processing off. To remove the saved appearance, clear this site's data. We will handle remaining personal data under the Privacy Policy.
Cookie choices and marketing-email subscriptions are separate. Clearing your browser does not reliably withdraw an email-marketing preference stored with your account. Use the unsubscribe or privacy-contact routes in the Privacy Policy.
8. Changes and your rights
We update this policy when relevant practices change, identify the effective version and explain amendments. The Privacy Policy's notice arrangements apply: any change other than an editorial one is announced by email and on our website at least 30 days before it takes effect, unless the law requires it to take effect sooner. Notice does not replace required consent or contractual acceptance. Corrections of typing or translation errors, formatting, clarifications that change no right or obligation, and updated contact or registration details take effect when published as a new version, without individual notice; each is recorded in the change log at the end of this policy. If a change adds or changes an optional category, the cookie notice asks for your choice again.
For access, correction, destruction, consent withdrawal or a complaint, contact support@v-ora.co. The Privacy Policy explains deadlines and how to complain directly to SDAIA. This policy is available in Arabic and English; the Arabic version prevails if they differ, subject to applicable law.
Change log
- Version 1.2 — 22 October 2026: the cookie notice's settings show one category, Necessary, which includes the appearance you pick (editorial).
- Version 1.1 — 22 October 2026: the appearance you pick is necessary storage, saved when you pick it; the website no longer stores the language, which is part of the page address; the cookie notice has one answer and no optional category; the earlier storage names are no longer listed.
- Version 1.0 — 22 October 2026: first published version.