Cookie policy
This Cookie Policy explains what cookies AxosHub sets in your browser when you use the AxosHub cloud productivity workspace (the "Service"), why we set them, how long they last, and whether they require your consent. It complements the Privacy Policy at /privacy and, for German-language readers, the Datenschutzerklärung at /datenschutz.
1. What is a cookie
A cookie is a small text file that a website places in your browser to store information across page requests. Some cookies are essential for the website to function; others are used for analytics, tracking or advertising. AxosHub uses only the first category — strictly necessary cookies.
2. Cookies used by the Service
| Name | Category | Purpose | Lifetime | Consent required |
|---|---|---|---|---|
| ax_ws | Strictly necessary | Signed session identifier that keeps you signed in to your Axos workspace after a magic-link sign-in | 90 days rolling | No (§25(2) TTDSG) |
| ax_csrf | Strictly necessary | Anti-CSRF token used to protect state-changing requests inside the workspace | Session | No (§25(2) TTDSG) |
| ax_pref | Strictly necessary | Stores the workspace's user-interface preferences (theme, sidebar width, calendar view) | 1 year | No (§25(2) TTDSG) |
| ax-cookie | Strictly necessary | Records your acknowledgement of this cookie banner so we do not show it again | 1 year (browser localStorage) | No |
3. Cookies we do not use
AxosHub does not use analytics cookies (no Google Analytics, no Matomo, no Plausible, no self-hosted analytics), does not use advertising cookies (no Google Ads, no Meta Pixel, no LinkedIn Insight), does not use social-plugin cookies, and does not use any tracking cookies operated by third parties. The Service does not embed content from third-party CDNs that would set cookies of their own.
4. Legal basis
Each cookie set by the Service is strictly necessary for the operation of the Service in the meaning of §25(2) TTDSG (Telekommunikation-Telemedien-Datenschutzgesetz) and, by extension, of Art. 5(3) ePrivacy Directive. Setting these cookies does not require your prior consent. We display a cookie banner on first visit purely as a transparency notice, not as a consent request; declining the banner does not disable any of the strictly necessary cookies (declining only records the acknowledgement so we stop showing the banner).
5. How to control cookies
You can delete or block cookies at any time through your browser's settings. Disabling the ax_ws cookie will sign you out of your Axos workspace on the browser in question; disabling ax_csrf will make it impossible to save changes inside the workspace. Because these cookies are strictly necessary, disabling them effectively disables the Service.
6. Local and session storage
The Service uses browser localStorage and sessionStorage to cache workspace data (notes, tasks and calendar entries) locally so that the workspace opens quickly on subsequent visits. These storages are functionally equivalent to strictly necessary cookies for the purposes of §25(2) TTDSG. The cached data is invalidated when you sign out or when the ax_ws cookie expires.
7. Third-party cookies through connected integrations
If you connect a third-party integration (Google, Slack, Zapier, GitHub, Linear, CalDAV) from /account, the OAuth flow of that third party may set its own cookies in your browser on its own domain. AxosHub does not control those cookies; you should refer to the cookie policy of the third-party service in question. Disconnecting the integration from /account revokes the OAuth grant and typically removes the associated third-party cookies.
8. Changes to this policy
We may update this Cookie Policy from time to time to reflect changes to the cookies we use. The current version and the effective date are indicated at the top of the page. Material changes are announced by email to the workspace address at least 30 days before they take effect.
9. Contact
Questions about this Cookie Policy may be sent to dpo@axoshub.org. Postal address: AxosHub GmbH — Data Protection Officer, Chausseestraße 22, 10115 Berlin, Germany.
The Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) is the competent supervisory authority for cookie compliance under the TTDSG and the GDPR. Complaints may be lodged at their office at Alt-Moabit 59-61, 10555 Berlin.
10. Detailed rationale for our cookie choices
We made a deliberate decision when designing AxosHub not to add tracking, analytics or advertising cookies. This decision has three consequences worth explaining.
The first consequence is that our understanding of how the workspace surface is used is intentionally coarse-grained. We know how many workspaces are active, how many notes are created per active workspace per week, how many magic links are issued per hour and how many sign-in attempts fail — all of that is measured on encrypted counters that do not disclose content. We do not know which paragraphs are read the most, which task boards are consulted the most often, or which calendar view is preferred by a specific seat. That is a conscious trade-off: the workspace surface belongs to its owner.
The second consequence is that our product roadmap depends more heavily on qualitative feedback than on quantitative behavioural analytics. We hold regular customer-council calls, run a public roadmap at /roadmap, and read every reply to our monthly changelog email. This is more work than reading a heatmap in a self-serve analytics dashboard, and we believe it produces better decisions in exchange.
The third consequence is that we do not need a complex "manage cookie preferences" panel with sliders per category. Because every cookie set by the Service is strictly necessary, there is no non-necessary category to opt in or out of. The transparency banner we do show is a single acknowledgement, not a consent gate.
11. Interaction with browser privacy features
The Service is designed to work correctly in browsers with strict privacy defaults, including Firefox's Enhanced Tracking Protection (strict mode), Safari's Intelligent Tracking Prevention, Brave's shields at default settings, and Chrome with third-party cookies disabled. Because we do not use third-party cookies, tracking pixels or cross-site fingerprinting techniques, those defences do not interfere with the operation of the workspace. Users who additionally block first-party cookies for arbitrary domains will find that they cannot stay signed in to their Axos workspace — this is because the ax_ws session cookie is strictly necessary and cannot be replaced by any equivalent mechanism that does not itself amount to a functional cookie.
12. Interaction with browser extensions
Some browser extensions marketed as "privacy tools" strip first-party cookies from certain domains or refresh the browser storage at every restart. If you use such an extension and configure it for axoshub.org, the ax_ws session cookie will be removed and you will need to sign in with a fresh magic link at every browser restart. We suggest whitelisting axoshub.org in your extension's settings for a smoother experience — no data is transmitted to third parties by our first-party cookies, so a whitelist entry does not weaken your overall privacy posture.
13. Do Not Track and Global Privacy Control signals
Our Service honours the Do Not Track header and the Global Privacy Control signal for the purpose of documenting that the browser has expressed a preference against tracking. Because we do not track visitors across sites in the first place, receiving either signal does not change the behaviour of the Service beyond recording the preference in the ax_pref cookie so that we do not present the transparency banner on subsequent visits.
14. Historic changes to this policy
This is version 1.4 of the Cookie Policy, effective from 1 August 2026. Previous material versions were published on 1 May 2026 (v1.3, added the ax_pref cookie), on 1 January 2026 (v1.2, added the localStorage section), and on 1 August 2025 (v1.1, updated the sub-processor references). The initial version was published on 15 March 2024. All historic versions of this policy remain available on request from dpo@axoshub.org.