Cookie Policy
This Cookie Policy, Version 1.2, complements Privacy Policy 1.1 and Terms of Use 2.4. It covers public account and portal pages on outcoraprediction.com and auth-staging.outcoraprediction.com. Test and live hosts use separate account sessions. It does not replace information for separately protected administrator interfaces.
Terms 2.4 · Privacy Policy 1.1 · Cookie Policy 1.2
1. Our approach
With separate permission through Cookie settings, OUTCORA uses Google Analytics 4 through Google Tag Manager to understand public-page visits, campaign links and registration steps. Refusal does not prevent account creation or access. Advertising storage, advertising personalisation and advertising user-data consent remain denied. No advertising pixels, session recordings or heatmaps are enabled by this integration.
2. Authentication cookie inventory
| Cookie | Lifetime and scope | Purpose |
|---|---|---|
outcora_session | Up to 8 hours; host-only, Path=/; HttpOnly, Secure, SameSite=Lax. | Maintain the signed-in account and portal session. |
outcora_oauth_state | Up to 10 minutes; host-only, Path=/; HttpOnly, Secure, SameSite=Lax. | Validate the Google login callback when you start that login method. |
outcora_terminal_handoff | Up to 60 seconds; host-only, Path=/terminal/; HttpOnly, Secure, SameSite=Lax; only where terminal handoff is enabled. | Pass a one-time authenticated handoff to the protected terminal; it does not purchase access. |
The account service uses server-side anti-forgery state, not a separate CSRF cookie. A separately enabled protected/prelaunch terminal may use outcora_prelaunch_session for its own session (up to 8 hours). That legacy/protected flow is distinct from the public account session.
3. Local storage, PWA and sound
The public page does not store Telegram clicks in localStorage. The obsolete outcora_last_cta entry may remain from an earlier version; the current code does not read or use it. You may remove it in browser site-data controls. The portal sound toggle exists only in page memory. The current service worker remains registered until removed by the browser or site; it serves an offline notice when a navigation request fails and does not write research, performance or customer responses into Cache Storage. Ordinary browser caching/history is separate. Installing the PWA does not provide offline current research or enable push.
4. Necessary storage and optional features
Analytics processing is based on your consent, which you can withdraw through Cookie settings at any time. It covers pseudonymous browser identifiers, device/browser information, visits, campaign labels and the listed interactions. Normal Google requests also disclose IP address and request metadata. The integration removes personal and authentication query parameters from measured URLs and uses only the referring website origin. It does not send form contents, email addresses, passwords, verification codes, account IDs or payment details. Never put personal information into campaign labels.
5. External requests
Production public fonts are served locally by OUTCORA; some staging pages load Google Fonts. Reference-price displays request data-api.binance.vision directly. Those requests disclose IP address and normal request metadata to the provider. Selecting Google login, Telegram or an enabled Whop checkout opens a separate provider context with its own privacy/cookie information. OUTCORA does not use those requests for behavioural advertising.
6. Your controls
Use browser settings to delete cookies/site data or unregister the service worker; use operating-system controls to uninstall the PWA. Blocking authentication cookies can prevent sign-in or terminate a session. Browser deletion or uninstalling the PWA does not cancel a subscription, unlink Telegram or erase server-side account records. Use the corresponding account, cancellation or privacy-request process. Sound can be disabled in the portal. Push is not currently activated by PWA installation.
7. Contact and updates
Contact Zero One Concept Kft. at support@outcora.net. This update adds the terminal handoff, the current PWA/storage behaviour and separate feature permissions; future changes will be dated. Privacy and Cookie Policy have their own version numbers, independently of Terms 2.4.
Optional analytics — Addendum 1.0, 7 October 2026
With separate permission through Cookie settings, OUTCORA uses Google Analytics 4 through Google Tag Manager to understand public-page visits, campaign links and registration steps. Refusal does not prevent account creation or access. Advertising storage, advertising personalisation and advertising user-data consent remain denied. No advertising pixels, session recordings or heatmaps are enabled by this integration.
Analytics processing is based on your consent, which you can withdraw through Cookie settings at any time. It covers pseudonymous browser identifiers, device/browser information, visits, campaign labels and the listed interactions. Normal Google requests also disclose IP address and request metadata. The integration removes personal and authentication query parameters from measured URLs and uses only the referring website origin. It does not send form contents, email addresses, passwords, verification codes, account IDs or payment details. Never put personal information into campaign labels.
Your host-only outcora_cookie_consent_v1 preference cookie lasts up to 180 days and records your choice, notice version and choice date; it contains no random user identifier. Optional _ga and _ga_* analytics cookies are configured for up to 60 days. outcora_campaign_v1 in sessionStorage retains campaign labels only after permission, within the browser tab, with a 30-minute inactivity limit. Withdrawing permission clears this campaign storage and the accessible Google Analytics cookies on this host and stops further measurement by reloading the page; it does not erase data previously collected or cancel your account.
Google Ireland Limited provides Analytics for EEA users; Google affiliates may process data outside the EEA, including in the United States. The transfer safeguards described in this Privacy Policy apply. Google processing terms and privacy information are linked below. GA4 user/event data retention must be set to two months before measurement is published; aggregated reports have separate retention. Use the contact and rights procedures in this Privacy Policy for questions or requests.