Legal

Cookie Policy

Last updated 2 October 2026

Draft, under legal review, not yet in force. This text describes how AWBack is meant to work and is being reviewed by counsel. Items marked TODO are still open.

Our approach

AWBack keeps what it stores in your browser to the minimum the service needs. The public pages of this website set no cookies. We do not use advertising cookies, tracking pixels or third-party scripts.

The client area uses one cookie, awback_portal. It is strictly necessary.

  • It is set only when you start something in the client area: signing in, signing up, or opening an invitation link.
  • It keeps you signed in, or holds a sign-in that is waiting for your second factor.
  • It is sealed (encrypted and signed), so its content cannot be read or changed in the browser.
  • Scripts in the page cannot read it (HttpOnly), and it is sent only over encrypted connections (Secure).
  • It lasts for at most 8 hours, and ends when you sign out.

It is not used to track you or for any other purpose.

Analytics without cookies

We count page views with Umami, an analytics tool we run ourselves. It works without cookies and stores nothing on your device. Your browser sends the page view to our own server, which passes it on; no other company receives it. Client-area pages are never counted. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted at all. The Privacy Notice explains what this involves.

The law asks for consent before anything is stored on or read from your device, except where it is strictly necessary to provide a service you asked for (Article 5(3) of the ePrivacy Directive, as applied in Greece). The client-area cookie is in that exception: without it, you could not stay signed in. Analytics stores nothing on your device, so it needs no consent either.

If we ever add something that needs consent, we will update this policy and ask for consent before it is switched on. TODO: counsel to confirm the Article 5(3) analysis for the deployed configuration, including Greek Law 3471/2006 Art. 4(5).

What we checked

This policy depends on what the site actually does, so we check it against the deployed site. At the last check, on 2 October 2026, the public pages set no cookies, and loaded nothing from any third-party host. Fonts are served from our own servers. Static files such as scripts, styles and images may come through our content delivery network, static.awback.com, which stores nothing in your browser.

We check again after any material change to the website or the client area.

Contact

Questions about cookies, tracking or privacy: legal@lambda-twelve.com.