Status: PUBLISHED Version: 1.0 Date: 2026-11-06 Owner: Data Protection Officer (contact: dpo@auroramembers.com) Jurisdiction: Canada (operating company); EU users served under the DSA and GDPR; market neutral Applicable law: Personal Information Protection and Electronic Documents Act (PIPEDA); for EU users, Directive 2002/58/EC (ePrivacy) as implemented in member-state law and GDPR Art. 6 and 7 Next review: 2027-05-06, or sooner if a cookie is added or changed
This policy lists every cookie and every piece of browser storage Aurora uses, what each is for, and how long it lasts. It is maintained by the engineering team from the deployed code and is updated before any change ships. It should be read together with the Privacy Policy.
1. The short version
- Aurora sets three cookies, all of them necessary to run the site: one that records your "I am 18 or older" answer, and two that keep you signed in and protect your account when you have one.
- Aurora sets no advertising, tracking, or social-media cookies, and loads no third-party ad or tracking scripts.
- Page views are counted by software on Aurora's own server that sets no cookie and stores nothing on your device. It is not loaded at all if your browser sends Do Not Track or Global Privacy Control.
- Because nothing optional is stored on your device, Aurora shows no cookie banner. There is nothing to accept or reject.
2. What are cookies
A cookie is a small text file a website stores on your device. Similar technologies include localStorage and sessionStorage, which store data in your browser for a site to read later. In this policy "cookies" covers all of these, as Art. 5(3) of the ePrivacy Directive and the national laws implementing it do, and as PIPEDA does for people in Canada. Aurora applies the same standard to every visitor, wherever they are.
3. Cookies and storage Aurora uses
| Name | What it does | Category | Type and attributes | Lasts | Set by |
|---|---|---|---|---|---|
aurora_age_ack | Records that you confirmed you are 18 or older, so the confirmation is not asked on every page. Contains the value v1 and nothing else. | Strictly necessary (legal age interstitial) | HTTP cookie, HttpOnly, Secure, SameSite=Lax | 1 year | auroramembers.com |
ory_kratos_session | Keeps you signed in to your account. Set only when you sign in. | Strictly necessary | HTTP cookie, HttpOnly, Secure, SameSite=Strict | 24 hours, extended while you use the site | auroramembers.com (our identity service) |
csrf_token_… (name ends in a long code) | Protects the sign-up, sign-in, recovery and account-settings forms against cross-site request forgery. Set only on those pages. | Strictly necessary | HTTP cookie, HttpOnly, Secure, SameSite=Strict | Until the browser session ends | auroramembers.com (our identity service) |
aurora.onboarding.draft.v1 | Holds the draft of a provider's ad while they work through the sign-up wizard, so a page refresh does not lose it. No password is ever stored in it. | Strictly necessary (the function you asked for) | sessionStorage, same tab only | Until the tab is closed | auroramembers.com |
aurora_invite | Set only when you open an invite link (an address starting auroramembers.com/i/). Holds the invite's code and nothing else, so that if you apply to advertise, your application is marked as invited and read first. | Strictly necessary (the function you asked for) | HTTP cookie, HttpOnly, Secure, SameSite=Lax | 30 days | auroramembers.com |
aurora.founding-intro.seen | Remembers that you have seen the short note about founding spots on the home and advertising pages, so it does not open again on every page. Contains the value 1 and nothing else. | Strictly necessary (interface) | sessionStorage, same tab only | Until the tab is closed | auroramembers.com |
aurora_locale | Set only when you pick a language (the language menu, or a link ending ?lng= and a language code). Holds the two-letter language code and nothing else, so the next page opens in the language you chose. | Strictly necessary (interface setting you asked for) | HTTP cookie, HttpOnly, Secure, SameSite=Lax | 1 year | auroramembers.com |
__cf_bm | May be set by Cloudflare, which stands in front of Aurora to absorb attacks, to tell real browsers from automated traffic. | Strictly necessary (security) | HTTP cookie, Secure | 30 minutes | Cloudflare |
That is the complete list. Aurora does not use localStorage, sets no theme or region cookies (the only language cookie is the one above, set when you choose a language), and does not set a consent cookie because there is no consent to record.
4. Page-view counting without cookies
Aurora counts page views with Umami, open-source analytics software running on Aurora's own server at stats.auroramembers.com. No analytics company receives anything.
- It sets no cookie and writes nothing to your browser's storage.
- Each page view sends the page's path (with the query string and fragment removed), the referring site, your screen size, your language, and the browser and operating-system family from your user agent.
- Your IP address is used only to derive a country and is not stored. Visits are grouped by a hash of the IP address, the user agent and a secret that changes every day, so a visitor cannot be recognised from one day to the next.
- The script is not loaded at all when your browser sends Do Not Track or Global Privacy Control.
Several EU data protection authorities treat first-party audience measurement configured this way (no cookie, no cross-day identifier, aggregate output only) as outside the consent rule in ePrivacy Art. 5(3). Aurora relies on that position and on legitimate interest (GDPR Art. 6(1)(f)) for the counting itself. You can block it by turning on Do Not Track or Global Privacy Control in your browser, which Aurora honours without exception.
5. Why there is no cookie banner
Consent is required before storing or reading anything on your device that is not strictly necessary for a service you asked for. Everything in section 3 is strictly necessary: the age confirmation is a legal interstitial, the session and anti-forgery cookies exist only to run the account you created, the wizard draft exists only to keep what you typed, and Cloudflare's cookie exists only to keep the site up. The analytics in section 4 store nothing on your device. So there is nothing for a banner to ask about. If Aurora ever adds a cookie that does need consent, this policy will change first and a consent prompt will appear before that cookie is set.
6. Your controls
- Age confirmation: clear cookies for auroramembers.com in your browser and the confirmation is asked again on your next visit.
- Sign-in: use Sign out in the header or your account menu; it removes the session cookie.
- Wizard draft: closing the tab discards it. Nothing is kept on your device after that.
- Page-view counting: turn on Do Not Track or Global Privacy Control in your browser.
- Everything: your browser's cookie and site-data settings override all of the above.
7. Do Not Track and Global Privacy Control
Aurora reads both signals and treats either as an instruction not to count the visit. No other processing on Aurora depends on consent that these signals could withdraw.
8. Changes to this policy
Aurora will update this page before adding, removing or changing a cookie, and will record the date at the top. Material changes to how your device is used are announced on the site before they take effect.
9. Contact
Questions about cookies or about anything in the Privacy Policy: dpo@auroramembers.com.