01Scope and website owner
This policy is provided by Huberway LLC, a Wyoming limited liability company, with its registered office at 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801, United States; EIN 35-2903558.
This notice covers www.huberway.com, this legal portal and Huberway LLC product storage described below. Authenticated products use distinct session/security and interface storage; independent merchants and third-party destinations supply their own controller notices. The functional hw_locale language choice can be shared across huberway.com subdomains; other host choices do not automatically apply elsewhere.
02Cookies and local storage
Cookies are small values a website can ask a browser to store and return with later requests. Local storage also stores values in the browser, but the browser does not automatically send those values with every HTTP request. Similar rules may apply to either technology depending on the purpose and applicable law.
The legal portal uses the optional hw_locale language preference cookie when you explicitly select a mode. Document search, the reading index and reading progress work within the page without localStorage. Its fonts, scripts and logos are hosted with the site. The portal has no embedded advertising, social-media widgets or audience-analytics code.
The inventory below describes the corporate application. Infrastructure-level security storage and changes to integrations must be inventoried according to their actual purpose.
03Corporate website storage inventory
huberway-cookie-consent — first-party localStorage on www.huberway.com; version, time and analytics/marketing choices. Valid in the application for 180 days. LocalStorage has no native expiry, so an inert expired value may remain until replaced or cleared.
hw_locale — preference cookie written only after an explicit language choice; en, it or auto; up to one year, Path=/, SameSite=Lax and Secure over HTTPS. On huberway.com it can be shared with its subdomains. Initial device-language detection does not write this cookie. It carries no identity or consent.
The former huberway-orion-demo-total entry is no longer written by the current counter: it reads shared server counter data. Old device entries can remain until cleared. The public counter is not a personalised usage invoice.
Authenticated products also use session, security and local interface preferences. Their names and durations depend on the deployed product and configuration. Expandigo uses its own cookie-choice manager; merchant storefronts use their own controller notice. A choice on one host does not generally authorise tracking on another.
04Optional analytics and marketing
www.huberway.com loads the Huberway Analytics pixel from analytics.huberway.com only after an analytics choice. It measures configured visits/events. Rejecting or withdrawing that choice blocks subsequent requests from this pixel; earlier server records are addressed through privacy rights and retention. No advertising integration is installed in this corporate application. A marketing preference does not by itself authorise sending messages or identify a visitor.
Where consent is required, optional tracking stays off until an informed affirmative choice. Scrolling, silence, an AI suggestion or continuing navigation is not consent. Replay, individual visitor identification and email open/click tracking need their applicable separate notices and choices. Huberway Analytics being first-party software does not automatically make every measurement strictly necessary.
05Change your choices
On the corporate website, use “Cookie settings” in the footer to reopen preferences, reject optional categories or save a new choice. The setting belongs to that host and browser. Opening this legal portal does not change an existing choice on www.huberway.com.
Use your browser’s privacy or site-data settings to inspect or remove localStorage and cookies, including the Orion counter entry. Removing consent storage means the corporate website will ask for a choice again. Blocking storage may prevent choices or display state from persisting, but the legal documents remain readable.
Consent withdrawal takes effect for future optional processing; it does not automatically reverse prior processing or cancel a separate service contract. For personal-data rights, use the contact route in the Privacy Policy.
06Links and external services
An ordinary link to Expandigo, Esdra, a login platform or an email address does not embed that destination’s scripts in this page. Following the link or choosing to send an email brings you into the destination’s service and its applicable notices. A link is not a blanket consent to tracking by that destination.
Server request logs, payment records and customer databases are not browser cookies. Their processing is addressed in the applicable Privacy Policy and service documentation, rather than concealed within a cookie category.
07Updates and contact
The inventory must be reviewed when application code, hosting protections or third-party integrations change. A new provider or purpose requiring consent must not start merely because this text was updated.
For questions about browser storage, contact hello@huberway.com with “Cookie policy” in the subject. For the wider handling of personal information, read the Privacy Policy at /privacy-policy.
08Product storage and choices
My Huberway uses account-session/security cookies and functional preferences. Its optional hw_locale language preference lasts up to one year. The encrypted hw_legal_flow or __Host-hw_legal_flow cookie binds a new-account acceptance to its authentication flow for up to 5 minutes; it does not authorise marketing or tracking. The selected organisation is stored in sessionStorage; domain cart, favourites and history in localStorage have no native expiry. Expandigo keeps its expandigo:cookie-consent receipt for 6 calendar months and public-research drafts in sessionStorage for up to 2 hours in the application. It also uses account/security/interface preferences. The optional tracker registry is currently empty in the reviewed application. A blank registry does not establish that server logs or infrastructure storage are absent.
Meet stores its versioned analytics preference in hw-meet-cookies-HW-LEGAL-2026-10-05 localStorage, valid in the application for 180 days. Where Google Analytics is configured, the built-in tag requires an analytics opt-in and respects browser DNT/GPC signals. Reject or reopen preferences from the footer; withdrawing disables the tag, removes accessible GA cookies and reloads the page. The old allow-all marker does not supply a current consent. Administrators must separately classify any additional custom scripts and respect the choices; the built-in preference does not authorise them.
The Analytics product interface uses cc_cookie for consent levels/revision, with a 182-day browser expiry in the supplied configuration, and cookie_consent_logged_20261005 for up to 182 days to avoid duplicate recording. Preferences can be reopened and changed. This is distinct from the visitor tracker installed by a customer on its own sites: the customer must connect that tracker and any replay or identification to its actual notice and consent mechanism. Orion’s reviewed interface offers technical session/interface storage information; a technical notice is not optional analytics consent. Independent Esdra merchants and customer websites supply their own specific storage inventory.