1. What cookies are

Cookies are small text files stored on your device by your browser. We also use similar technologies including web beacons, pixel tags, local storage, and session storage. In this Cookie Policy we refer to all of these as “cookies.”

We use both first-party cookies (set by hangaros.com) and third-party cookies (set by services we use, such as Google Analytics and Zoho SalesIQ).

2. Categories of cookies we use

2.1 Strictly necessary (always on)

These are essential to operate the Service and cannot be disabled.

Cookie	Set by	Purpose	Duration
accessToken	HangarOS	Authentication. HttpOnly, Secure, SameSite=Strict.	Session (~1 hour)
idToken	HangarOS	Authentication. HttpOnly, Secure, SameSite=Strict.	Session (~1 hour)
refreshToken	HangarOS	Re-authentication. HttpOnly, Secure, SameSite=Strict.	30 days
csrf-token	HangarOS	Cross-site request forgery protection (double-submit pattern). Secure, SameSite=Strict.	Session
Payment processor cookies	Payment processor — to be designated	Payment-form session and fraud detection set by the third-party Payment Processor we engage; cookies and their durations will follow that processor's policy and will be listed here once a processor is engaged.	Per processor
_zcsr_tmp, siqlsdb	Zoho SalesIQ	Chat widget session and chat-state cookies for the customer support chat.	Session / persistent (per Zoho)

Legal basis: legitimate interest in delivering and securing the Service.

2.2 Analytics (consent-based where required)

These help us understand how the Service is used so we can improve it. Where applicable law requires consent (such as in the EEA/UK), we ask for your consent before setting these.

Cookie	Set by	Purpose	Duration
_ga, _ga_*	Google Analytics 4	Distinguish visitors.	Up to 2 years
_gid	Google Analytics 4	Distinguish visitors.	24 hours
_gat	Google Analytics 4	Throttle request rate.	1 minute
ph_, posthog_	PostHog	Product analytics: feature usage, session identifiers (not session recordings of inputs — inputs are masked).	Persistent
Signed-in visitor identification	Zoho SalesIQ	If you are signed in and have consented to analytics, we share your name, email, and account ID with the SalesIQ chat widget so support agents can identify you instead of seeing an anonymous visitor.	Session

2.3 Marketing / advertising (consent-based where required)

These help us measure the effectiveness of advertising campaigns.

Cookie	Set by	Purpose	Duration
gclid (URL parameter, persisted to PostHog)	Google Ads	Conversion attribution for ad clicks.	Session and persisted as a PostHog person property
Google Ads conversion cookies	Google	Measure ad conversions.	Per Google's policies

2.4 Functional (consent-based where required)

Cookie	Set by	Purpose	Duration
User preferences	HangarOS	Remember UI preferences such as theme and sidebar state.	Persistent (local storage)

3. Local storage and session storage

In addition to cookies, the Service uses browser local storage and session storage for the following purposes:

Theme and UI preferences (light/dark mode, sidebar state)
Active location / base selection for multi-location flight schools
Per-user notification preferences
Cached company-context data with a 24-hour TTL
Cached chief-instructor designation with a 12-hour TTL (cleared on logout)
Command palette recent commands
Timezone preference for the scheduling calendar
Authentication refresh rate-limit cooldown (session storage)

Local storage entries persist until cleared by you (through browser settings) or by the Service. Session storage entries are cleared when you close the tab.

4. Managing your cookie preferences

You can manage cookies in the following ways:

Cookie banner. On your first visit to hangaros.com you will see a banner at the bottom of the page where you can accept all, reject the non-essential categories, or open the preferences panel to choose categories individually.
Manage cookies. You can re-open the preferences panel at any time using the link in the site footer or here on the Cookie Policy page.
Browser settings. Most browsers allow you to view, delete, or block cookies. Blocking strictly necessary cookies will prevent the Service from functioning.
Global Privacy Control (GPC). We honor GPC signals as an opt-out of “sale” and “sharing” where required by law. We do not sell personal information.
Do Not Track (DNT). No common industry standard for DNT exists; we do not respond to DNT signals separately from GPC.

To opt out of Google Analytics specifically, install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

5. Third-party cookies

Third-party services we use have their own cookie practices:

Google: policies.google.com/technologies/cookies
Zoho SalesIQ: zoho.com/privacy.html
PostHog: posthog.com/privacy
Sentry: sentry.io/legal/cookie-policy
Vercel: vercel.com/legal/cookie-policy
Payment processor — links will be added once a Payment Processor is engaged.

We are not responsible for the cookie practices of third parties.

6. Changes to this Cookie Policy

We may update this Cookie Policy from time to time. We will post the updated version with a new effective date and, where changes are material, send notice by email to the address associated with your Account.

7. Contact

Questions about this Cookie Policy: privacy@hangaros.com

OrangeTree Technologies LLC d/b/a HangarOS
4801 Glenwood Ave, Suite 200, Mailbox 31
Raleigh, NC 27612
United States

Last updated: July 15, 2026.