Cookie notice
Effective date: September 13, 2026.
Only technical cookies
The ohmyho.st website and platform use only technical cookies and similar storage for security, login, access to a requested environment and remembering a necessary interface preference. We do not set advertising cookies, analytics identifiers or cross-site profiling cookies on these pages. The small notice is informational; its OK button dismisses the notice and does not give marketing consent.
| Technology | Purpose | Duration / scope |
|---|---|---|
| omh_referral | Remember the entry link’s r value and whether to show the beta login link; no unique visitor identifier | Up to 30 days; first-party, Secure, HttpOnly, SameSite=Lax |
| omh_cookie_notice | Remember that you dismissed the technical-cookie notice | Up to 180 days; first-party website preference, no unique visitor identifier |
| __Host-omh-session | Keep the authenticated account portal session, protect form actions and renew WorkOS access server-side | Up to seven days; encrypted and authenticated, host-only, Secure, HttpOnly, SameSite=Lax; cleared on logout or invalidation |
| __Host-omh-login | Protect the browser login handoff using state and PKCE | Up to ten minutes; Secure, HttpOnly, SameSite=Lax; cleared after the handoff |
| __Host-ohmyhost_dev_access | Authorise access to a private customer Dev environment after a single-use link is redeemed | Up to twelve hours; host-only, Secure, HttpOnly, SameSite=Lax |
| Authentication and security cookies used by the selected login service | Maintain the requested login and protect authentication | The login service's session/security expiry; only when that service is used |
| Cloudflare security cookies, where its protection requires them | Detect abusive traffic or remember a successfully completed security challenge | According to the enabled security mechanism; for example, __cf_bm expires after 30 minutes of inactivity and challenge clearance follows the configured expiry |
| omh-feature-* in session storage | Keep the request identifier when you press a feature-interest button, so a retry does not create another request | Current browser-tab session; no email or message content |
The hosting CLI's locally stored credentials are not website cookies. Application-auth cookies in a customer's own application are controlled by that customer. Likewise, a separately opened GitHub, identity-provider or payment-provider page operates under that provider's own cookie notice; this notice does not classify those independent sites' cookies.
Your controls
You can remove or block cookies in your browser and clear site storage. Blocking a login, security or private-access cookie can prevent the function you requested from working. Removing the notice preference displays the notice again. There are no optional tracking categories to enable or reject on the ohmyho.st website.