The public website
The public Box Ox pages do not require an application login or advertising cookies. Optional Google Analytics stays off until you allow it. Clipboard controls, code examples, documentation, and downloads work when you decline analytics.
Analytics storage
The local-storage key boxox.analytics.v1 records your analytics choice and its expiry for up to 180 days. It is used to remember that choice, including a refusal. If you allow analytics, Google Analytics may set first-party _ga and _ga_* cookies for visitor and session measurement. Their configured lifetime is up to 180 days without automatic renewal. Advertising storage remains denied.
No Google Analytics script is loaded while your choice is unknown or declined. A detected Global Privacy Control signal also keeps it off. Withdraw through ; the page disables measurement, clears these cookies, and reloads to unload the tag. Existing data already sent to Google is subject to the retention described in our privacy notice.
Cloudflare services
Cloudflare may use cookies or similar mechanisms when security, bot protection, challenges, or other configured services require them. Their use depends on the features operating on a request. See Cloudflare’s cookie documentation for the services and cookie names it describes.
Your separate Box Ox installation
An Access-protected installation is separate from this public website. Cloudflare Access uses authentication cookies to manage sign-in. The installed app may use browser storage for preferences and tab-scoped developer credentials. The installation operator controls its configuration and should provide an appropriate notice.
The Add domain flow can keep a scoped Cloudflare token in an encrypted, HttpOnly, Secure cookie for up to 15 minutes. It is bound to the signed-in owner, account, and organization and scoped to domain-management requests. Disconnect removes that browser cookie.
Connect with Cloudflare uses a separate encrypted, HttpOnly authorization-state cookie for up to ten minutes. After approval, credentials are stored encrypted in the installation’s D1 database and renewed automatically until disconnected or revoked. Connection details.
Your controls
You can manage cookies and site storage in your browser. Blocking authentication cookies may prevent sign-in to an Access-protected installation. Use the Analytics settings control in the footer to allow or decline optional measurement. Declining does not restrict downloads or documentation.
Questions? Email hello@boxox.dev. Read the privacy notice.