Cookies & browser storage

Sky cookie and storage notice

Effective date: 14 October 2026

This notice describes browser storage and related resources on Sky's public website and signed-in application. The Sky preference control governs Sky-managed optional analytics; it does not certify the site or control every hosting resource.

Sign-in and security cookies

On the application host, the __Host-sky-buyer cookie maintains a signed-in Sky account session. It is host-only, Secure, HttpOnly, SameSite=Lax and Path=/. Its configured maximum age is 12 hours. OAuth sign-in also uses host-only state cookies to protect the sign-in flow. Authentication cookies are not shared across the public and application hosts. Sky stores the authenticator secret encrypted and one-use recovery codes as hashes on the server; they are not browser cookies.

Functional interface preferences

The signed-in workspace remembers theme, navigation and tour preferences in local browser storage. Where used, the host-only sidebar_state cookie remembers the sidebar layout with a seven-day maximum age. These preferences are not advertising identifiers. Clearing them resets the corresponding interface choices without deleting your account.

Optional activity and your consent choice

Sky-managed optional analytics stays off unless you allow it through the cookie notice. With permission, the public activity panel creates a random per-tab sessionStorage identifier under sky-active-browser-v1 and sends visible-tab heartbeats about every 30 seconds. The panel counts tabs seen in the last 90 seconds; the server keeps a hashed identifier, estimated country and last-seen time with an approximately one-day expiry. Guide, worksheet and booking metrics use fixed event labels, not worksheet answers or full page URLs.

Your sky-cookie-consent-v1 preference is kept in localStorage on this browser origin for up to 180 days. It stores a version, necessary-storage setting, analytics choice and local timestamps, not an account identifier. Reject or withdraw to stop future Sky-managed optional events and remove the activity identifier. Authentication, interface preferences and forms you choose to submit are unaffected. Global Privacy Control keeps optional analytics off. If storage is blocked, the choice remains only for the current page session. Main-site and app preferences do not automatically sync.

Open cookie settings

Cloudflare bot verification

Protected account sign-in, signup, recovery and provider-linking actions use Cloudflare Turnstile. The widget sends bot-check metadata and a verification token to Cloudflare, and Sky checks the token on its server. Sky does not send your email address or password to the verification endpoint; those fields go separately to Sky. A successful robot check is not sign-in, MFA verification or a legal certification.

External resources and hosting telemetry

The live site loads Manus platform analytics and externally hosted font resources, including Google Fonts. These requests can disclose an IP address and request metadata to those services. Sky's optional-analytics choice does not control this hosting telemetry or every external resource, so this notice does not claim that no third party is contacted before a choice. Platform event details, identifiers, retention and available controls still require provider verification.

Sky's public site and application run on Manus-hosted infrastructure. A domain-warm-up draft, manual DNS check or browser-only diagnostic is not itself a cookie or tracking technology.

Questions

For cookie or personal-data questions, email privacy@skyteknologies.com. More detail about data use, service connections and individual rights is in the privacy notice.