Cookie Policy

Strictly necessary

Session and authentication tokens, the pre-launch access flag and the in-app session guard are required for the interface to work correctly. They are set only when you sign in or pass the entry gate.

Preferences

Your language, your audio setting, your last selected place and the position of an open panel are remembered so the interface returns exactly as you left it.

Caches

Results from public sources — a weather reading, a ranking page, a search stream page — are cached in your browser for a limited time so that revisiting a topic costs no network. They contain public data only.

No analytics, no advertising

No third-party analytics, advertising or cross-site tracking cookies are set. UNIHOLIX does not participate in advertising networks.

How to control them

Clearing your browser's site data for UNIHOLIX removes every value listed below. Doing so signs you out and resets your preferences on the next visit; it never affects your account balance, which lives on the server.

Keys this site keeps in your browser

These values live only in your browser's local storage. None of them is sent to UNIHOLIX servers, and clearing site data removes all of them.

• unitas.weather.v1localStorageLast weather place and forecast so the weather slot renders instantly. 10 minutes, then refetched.
• unitas.gastronomy.local.v1localStorageNearby eateries found on Wikipedia around your place for the gastronomy slot, so revisiting costs no request. 24 hours, then refetched.
• unitas.geo.cache.v1localStorageGeocoding results for city searches and "my location". Least-recently-used, 240 entries.
• unitas.uai.websynth.v4localStorageLive web synthesis for a search term (Wikipedia / Wikidata excerpts). 24 hours, 40 entries.
• unitas.uai.shortcut.pulse.v1localStorageMomentum ledger for keyword tiers (trend arrow). 60 entries.
• unitas.ouroboros.ladder.v2sessionStorageThe keyword ladder you built, so a language switch restores it. Cleared when the tab closes.
• unitas.swarm.cache.v1localStorageOrganisations you have taken apart in the omni-tech swarm, so revisiting one costs no request. 7 days, 40 entries, least-recently-used.
• unitas.uai.stream.v1localStorageInfinity stream pages for a search term, plus your depth and engraving tier. 24 hours (news 15 minutes), 120 entries.
• unitas.uai.suggest.v1localStorageKeyword ladder suggestions for typed prefixes. 24 hours.
• unitas.localeSwitch.v1sessionStorageScroll position and open search state carried across a language change so the page lands where you were. Consumed on the next render; expires after 5 seconds.
• unitas.sitePage.open.v1sessionStorageWhich footer page (terms, privacy, ...) is open, so a language change keeps it open. Removed when the page is closed or the tab reloads.
• unitas_audio_preflocalStorageYour sound on/off choice ('on' or 'off'); absent means sound on. Read by the site-wide audio provider, the haptic clicks and the logo-page chime. Until you change it or clear browser data; deliberately kept across an app exit.
• unitas_locale_autodetectedlocalStorageA '1' flag that the browser language was checked once for an automatic language switch, so the guess is never repeated on this device. Until browser data is cleared.
• unitas_locale_preflocalStorageThe language you chose manually, so any later visit on this browser re-applies it (a cookie of the same name is the fallback copy). Until you pick another language or clear browser data; kept across an app exit.
• unitas_visit_ledgerlocalStorageWhere you were on the site (curtain phase, ad segment, open cluster surface, locale) plus a timestamp, so an installed app relaunching shortly after being backgrounded returns to the same place instead of replaying the logo page. Holds no identity or entitlement. Honoured for 30 minutes; removed on a fresh entry to the site and on a confirmed app exit.
• unitas.guest.v1localStorageA local, throwaway guest identity (random id, 6-digit virtual number, created time) that lets you look around without an account. It is not a server account. Until you sign in to a real account, end guest mode, or clear browser data.
• unitas.inapp.escape.atlocalStorageThe time (epoch ms) of the last automatic attempt to hand an in-app browser (KakaoTalk, LINE, Facebook, Instagram, ...) over to the real system browser, so the attempt fires at most once per 90 seconds. Overwritten on each attempt; only meaningful for 90 seconds; stays until browser data is cleared.
• unitas.lockin.active.v1localStorageThe keys of the lock-in modules you activated, so the activation survives reloads and language switches. Until you deactivate the module or clear browser data.
• unitas.mail.reservation.v1localStorageThe @uniholix.com handle you reserved at sign-up, when, and its status ('pending', 'claimed' or 'lost'), so the account surfaces can show it. Until browser data is cleared; the code never removes it, only overwrites it when the status changes.
• unitas.pwa.installedlocalStorageA '1' flag raised when the app was installed on this device, so a later browser-tab visit can point you to the installed app instead of a dead install button. Removed the moment the browser offers installation again (the app is no longer installed); otherwise until browser data is cleared.
• unitas.shorts.orphanCleanup.v1.donelocalStorageA '1' flag that the one-time cleanup of data left behind by the retired UNIHOLIX Shorts feature has already run on this device. Until browser data is cleared.
• unitas.uai.brain-grid.v1localStorageYour U-AI search history on this device: query, time, shield score and depth ('surface' or 'deep'), shown as the history strip. Signed-in accounts also get a server copy. Newest 60 entries; removed entirely by the 'wipe history' action; otherwise until browser data is cleared.
• unitas.wallet.prefs.v1localStorageYour wallet preferences: auto-spend on/off, limit and window, auto-refill on/off, threshold and package. Settings only -- no balance, no payment details. Until you change them or clear browser data; kept across an app exit.
• unitas_audio_gate_seensessionStorageA 'true' / '1' flag that the audio-unlock gate has already been passed in this tab (set when you dismiss it, or when the curtain releases the site), so the gate is not shown a second time. Cleared when the tab closes; also wiped on a fresh entry to the site and on a confirmed app exit.
• unitas_cinema_phasesessionStorageThe pre-launch curtain phase this tab is parked on ('gate', 'cinema', 'sealed' or 'released'), so a refresh re-renders that page in place instead of replaying the logo page. Cleared when the tab closes; wiped on a fresh entry to the site and on a confirmed app exit; removed by the founder console's revoke/replay.
• unitas_cinema_segmentsessionStorageWhich of the five cinema ad segments (1-5) is on screen, so a refresh during the ad resumes at that segment. Removed as soon as the cinema phase ends; cleared when the tab closes.
• unitas_console_triggersessionStorageThe founder-console action ('revoke', 'splash', or a ?dev= action) carried across a reload so the next document knows the load is a console transition. Only the founder console writes it. Cleared by the next document after it is read; cleared when the tab closes or on a fresh entry.
• unitas_handoffsessionStorageA '1' flag set just before the installed app redirects itself from '/' to your saved language root, so the next document treats that load as a continuation, not a fresh entry. Consumed (removed) by the very next page load.
• unitas_leave_atsessionStorageA timestamp written when the page unloads normally (pagehide). Its absence next to a live phase record tells the next load the document died without warning, so the state is restored instead of reset. Consumed (removed) at the next page load and re-armed on the next unload; cleared when the tab closes.
• unitas_sovereign_panel_collapsedsessionStorage'1' or '0' -- whether the founder debug panel is collapsed. Only a verified founder session ever renders the panel, so public visitors never write this. Cleared when the tab closes.
• unitas_splash_activesessionStorageA '1' flag raised for exactly as long as the 3-second logo page is on screen, so a refresh during the logo page replays it instead of skipping ahead. Removed the moment the logo page finishes; cleared when the tab closes or on a fresh entry.
• unitas.mail.claim.attempt.v1sessionStorage'<account id>:<handle>' of the one @uniholix.com handle claim attempted in this tab, so a failed claim is retried on the next load rather than in a loop. Cleared when the tab closes.
• unitas.ouroboros.query.v1sessionStorageThe text currently typed in the search bar, so a language switch (which remounts the page) restores it. Overwritten on every keystroke; cleared when the tab closes.
• unitas.ouroboros.shortcut.v1sessionStorage'<group>:<key>' of the shortcut popup that is open, so a language switch reopens the same popup. Removed when the popup closes; otherwise cleared when the tab closes.
• unitas.qw.surface.v1sessionStorageWhich cluster pop-out (and which module inside it) is open on the home, encoded as 'core/<cluster>[/<moduleId>]', or '-' for explicitly closed, so a reload restores the same view. Cleared when the tab closes; wiped on a fresh entry to the site and on a confirmed app exit.
• unitas.selfheal.<scope>sessionStorageHow many times an error screen auto-reset itself in the current window and when the first attempt was, so a persistent fault cannot turn into a reload storm. 30-second window with at most 2 attempts; removed after a stable render; cleared when the tab closes.
• uniholix_today_tablocalStorageThe UNIHOLIX Today tab you opened last, so Today opens there next time. Until you open another tab or clear site data.
• uniholix_today_world_questionlocalStorageYour World Question answers, and a random value this browser makes so it cannot vote twice (the server keeps only a one-way code made from it, erased within three days after voting closes). The newest 14 days.
• uniholix_today_edition_voteslocalStorageYour answers to the votes in Today's daily editions, and the same kind of random value (not sent for Kids votes). The newest 90 votes.
• uniholix_today_letterslocalStorageLetters to your future self, kept sealed on this device until their opening date. They are never sent to UNIHOLIX. Until you delete them; at most 30 letters.
• uniholix_today_guesseslocalStorageYour Tomorrow Guess predictions, so Today can show whether they came true. The newest 60 days.
• uniholix_today_puzzleslocalStorageYour Number Grid progress, so a grid you started is still there when you come back. The newest 14 days.
• uniholix_today_signlocalStorageThe sign you chose in Fortune. Until you change it or clear site data.

Cookies this site sets

Unlike the keys above, cookies travel with every request to UNIHOLIX. Each one we use is listed here, and none of them serves advertising or cross-site tracking. Cookies marked HttpOnly cannot be read by page scripts.

• unitas_sovereignHttpOnlyHMAC-SHA256-signed founder session ('v1.<expiry>.<signature>'). It is the only thing the server trusts when deciding whether founder-only routes and UI exist for this browser. Never set for public visitors. 30 days (Max-Age 2592000); HttpOnly, SameSite=Lax, Path=/, Secure on https. Deliberately not revoked on app exit; revoked only by the explicit sign-out paths above.
• unitas_sovereign_hintcookieA client-readable hint that a founder session may exist, so client code knows to ask GET /api/sovereign/verify and the head bootstrap can pre-paint the released home. It grants nothing by itself. 30 days; not HttpOnly, SameSite=Lax, Path=/, Secure on https.
• unitas_locale_prefcookieFallback copy of the language you chose manually, for browsers that block web storage but allow cookies; also read by the installed-app launch bootstrap (lib/pwa/standaloneLaunch.ts) to open your language root. 1 year (max-age 31536000); Path=/, SameSite=Lax; not HttpOnly; no Secure attribute is set.
• NEXT_LOCALEcookienext-intl's locale cookie. Written only on document navigations, and only when an existing NEXT_LOCALE differs from the locale resolved from the URL, or when none exists and the browser's Accept-Language best match differs from the resolved locale. Because routing.ts sets localeDetection: false, the app never reads it back. Session cookie (no Max-Age/Expires -- gone when the browser closes); SameSite=Lax, Path=/; not HttpOnly.
• sb-<project-ref>-auth-token (split into sb-<project-ref>-auth-token.0, .1, ... when longer than 3180 bytes)cookieYour Supabase Auth session (access token, refresh token, expiry and user record), base64url-encoded with a 'base64-' prefix. Stored in a cookie rather than localStorage so the server can see who is signed in for the coin gate. 400 days (Max-Age 34560000), rewritten on every token refresh; removed (Max-Age 0) on sign-out. Path=/, SameSite=Lax, not HttpOnly (the browser client must read it).
• sb-<project-ref>-auth-token-code-verifiercookieThe PKCE code verifier for the most recently started sign-in flow, needed to complete that flow securely. Contains no personal data. Removed when the flow's code is exchanged or on sign-out; otherwise the adapter's default 400 days. Path=/, SameSite=Lax, not HttpOnly.
• sb-<project-ref>-auth-token-flow-<flowId>-code-verifiercookiePer-flow PKCE verifier slot so two sign-in attempts (for example in two tabs) do not overwrite each other. At most 5 slots exist; the oldest is evicted. Removed when that flow completes, when evicted by a 6th flow, or on sign-out; otherwise 400 days. Path=/, SameSite=Lax, not HttpOnly.
• sb-<project-ref>-auth-token-flows-code-verifiercookieThe list of pending PKCE flow ids (JSON array), which is how the library finds and cleans up the per-flow verifier slots. Removed when no flows remain or on sign-out; otherwise 400 days. Path=/, SameSite=Lax, not HttpOnly.
• uniholix_today_langcookieThe language you chose in UNIHOLIX Today, so its pages open in that language. 1 year (Max-Age 31536000); Path=/today, SameSite=Lax; not HttpOnly; Secure on https.