What this website and the Oneward platform store on your device, and the rules that govern it.
Last updated 15 September 20261.1 This Notice explains how Oneward uses cookies and similar technologies (localStorage, sessionStorage, pixels and SDKs, together "cookies") on the website oneward.com and in the Oneward platform.
1.2 Responsible party: Oneward, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA. EU representative: Oneward GmbH i.G., Hardenbergstraße 12, 10623 Berlin, Germany. Contact: privacy@oneward.com.
2.1 Under § 25 TDDDG (Germany), Article 5(3) of the ePrivacy Directive as implemented across the EEA and the United Kingdom, and the GDPR, storing or reading information on your device requires your consent unless it is strictly necessary to provide a service you have requested. Strictly necessary storage does not require consent (§ 25(2) TDDDG).
3.1 The website uses no advertising and no cross-site tracking technologies. It uses analytics tools (Google Analytics and PostHog) only with your consent, and it remembers your cookie choice so that it does not have to ask on every visit.
3.2 Whether we ask first depends on where you are, which we infer from your browser's time zone. In the EEA, the United Kingdom and Switzerland, a banner offers "Accept all" and "Reject all" with equal prominence, and a choice per category under "Cookie settings"; nothing that requires consent is stored before you decide, and no analytics run until you do. Elsewhere, analytics cookies are set by default, a notice tells you so, and you can opt out with one click. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and set no analytics cookies.
3.3 In all cases you can change or withdraw your choice at any time via , which is also linked in the footer of every page. Your choice is logged with its timestamp and version, and we ask again after 12 months at the latest, or earlier if the categories change.
3.4 The website uses the following storage:
| Name | Purpose | Category | Duration | Legal basis |
|---|---|---|---|---|
| oneward_cookie_consent (local storage) | Remembers your cookie choice, or that you have seen the notice, with its timestamp and version | Strictly necessary | 12 months | § 25(2) TDDDG; Art. 6(1)(c) GDPR together with Art. 7(1) GDPR |
| oneward-analysis-request-submitted-at (local storage) | Remembers that you sent a 30-day analysis request, so the form is not shown again for 24 hours | Strictly necessary | 24 hours | § 25(2) TDDDG; Art. 6(1)(b) GDPR |
| Google Analytics (_ga and _ga_* cookies) | Web analytics: which pages are visited, where visitors come from and how the site is used | Analytics | Up to 12 months | Consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR) |
| PostHog (ph_ cookies and local storage) | Web analytics: which pages and use cases are viewed and how the site is used | Analytics | Up to 12 months | Consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR) |
3.5 Where analytics are off, PostHog stores nothing on your device and receives only what you actively send us, such as a request for a 30-day analysis.
4.1 The platform (the signed-in application) uses the following storage:
| Name | Purpose | Category | Duration | Legal basis |
|---|---|---|---|---|
| Session cookie | Keeps you signed in and secures your session | Strictly necessary | Session, or up to 30 days with "remember me" | § 25(2) TDDDG; Art. 6(1)(b) GDPR |
| Authentication token | Authenticates requests to the platform | Strictly necessary | Session | § 25(2) TDDDG; Art. 6(1)(b) GDPR |
| CSRF token | Protects against cross-site request forgery | Strictly necessary | Session | § 25(2) TDDDG; Art. 6(1)(f) GDPR |
| Preference storage | Remembers interface settings such as language and layout | Functional | 12 months | § 25(2) TDDDG where necessary for a requested function; otherwise consent |
| PostHog (ph_ cookies and local storage) | Product analytics: which features are used and how, to improve the platform | Analytics | Up to 12 months | Consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR) |
4.2 PostHog is enabled for a User only after that User consents in the platform, with IP anonymization. Session recording, if used, is enabled only with consent and only for Users of the Customer; it is never applied to Workers who do not use the platform. Consent can be withdrawn at any time in the platform settings.
5.1 We honor Global Privacy Control signals: on the website, a browser that sends the signal is treated as having opted out of analytics cookies (Section 3.2). We do not respond to Do Not Track signals because there is no common standard for them.
6.1 You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent the website or platform from working.
7.1 We may update this Notice; the current version is available on this page with its date. Questions: privacy@oneward.com.