1. What this page covers

This page describes engine.orionquant.com: the product page with the waitlist, the documentation, the tools page, the interface (API) of the OrionQuant Backtesting Engine and the browser application at /app.

The website orionquant.com uses different cookies and has its own policy.

The desktop application sets no cookies. Sections 15, 27 and 29 of the Privacy Policy describe what it stores on your device and what it sends to us.

2. What we set, and why

We set two kinds of cookies: technically necessary cookies and, only with your consent, one cookie for page analytics. All of them are set only by engine.orionquant.com. They are not used to recognise you across sites, to build a profile or for advertising.

Technically necessary cookies. They serve to sign you in and keep your session in the browser, to protect against misuse through requests made in your name by other sites, and to give access to the browser application at /app through the waitlist while it is not yet open to everyone. The cookies for sign-in and protection last at most 10 hours, and the cookie for access through the waitlist up to 180 days.

These cookies are strictly necessary within the meaning of section 165(3) TKG 2021 (Austrian Telecommunications Act 2021) for us to provide the service you expressly ask for. They therefore need no consent.

Cookie for page analytics. PostHog sets it only after you agree in the cookie banner. It holds a random identifier of browser and visit and lasts up to one year. PostHog receives the data as our processor through our address relay.orionquant.com. Section 4 describes the page analytics.

When you request a sign-in code in the browser, the page also loads the bot check Turnstile from Cloudflare (challenges.cloudflare.com). It protects sign-in against automated requests and is required for that. Cloudflare receives your IP address and reads technical characteristics of your browser. Section 7 of the Privacy Policy describes Cloudflare's role.

3. What your browser stores besides cookies

Some entries in your browser's local storage are needed for features you use. They stay in your browser and are not sent to us as such.

On the website.

Entry	Purpose
`oq.consent`, `oq.consentId`	Your answer in the cookie banner with version and time, so that we do not ask on every visit. `oq.consentId` is a random identifier for that answer (section 4)
`oq-site-lang`	The language you chose on the site
`oq-docs-lazy-seen`	A technical flag of the documentation page that does not relate to you as a person
`oq.ref.v1`	A referral or partner code with the time of the click, written when an address with `?ref=` is opened, so that a new account can be attributed to the code. It applies for 7 days
`oq-survey-token` (session storage)	The access key from the link to the waitlist survey, so that the survey page still has it after a reload. It disappears when the tab is closed
`ph_…`, `__ph…`	Entries of page analytics, only after you agree (section 4)

In the browser application at /app. The application stores your working data in the browser so that it is still there after a reload:

in local storage, entries with the prefix oq.: language and layout of the interface, your local strategy library with code, run settings, presets, drawings, audit summaries, the last 40 messages of the conversation with the assistant, the history of simulated live results, the e-mail address last used to sign in, and oq.accountDeleted, a flag with which the application shows a confirmation after an account deletion and which is then removed,
in the browser database (IndexedDB), oq.runs with your completed runs and oq.audits with your audits,
in session storage, short-lived entries that disappear when the tab is closed.

These entries are required for the application to work the way you use it (section 165(3) TKG 2021). The Privacy Policy describes which of them reach our servers, for example when you save a strategy to your account.

4. Page analytics, only with your consent

The product page, the documentation and the tools page are measured only if you agree in the cookie banner. Before you answer and after you decline, nothing is loaded and nothing is sent for this purpose. The browser application and the API have no page analytics.

The processor is PostHog with its EU cloud in Frankfurt. The data passes through our address relay.orionquant.com, which Cloudflare operates for us, to PostHog.

What is sent: the pages opened, the time before leaving and the scroll depth, the sections reached, the submission of the waitlist form and where on the page it was sent from, and the tab opened in the audit example. In addition: browser, operating system, screen size and the referring page.

Addresses are sent without their parameters, except campaign parameters (utm_…) and ref. Links from our mails that carry personal tokens therefore do not reach PostHog.

The ph_… entries hold a random identifier of browser and visit. They are set only after you agree, only on engine.orionquant.com, and last up to one year.

The project discards IP addresses on arrival. Session recording, automatic click capture, heatmaps and surveys are switched off. The data is not linked to a name, an e-mail address or an account and is not used for advertising.

The legal basis is your consent under Art. 6(1)(a) GDPR and section 165(3) TKG 2021.

Record of your answer. We store every banner answer as proof in our database in Finland: the random identifier, the answer, the version shown, the language and the time. We do not store an IP address or a user agent with it. If you change your answer, a new entry is created so that earlier entries show what applied before. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR.

An answer is valid for 12 months, after which the banner asks again. It also asks again if this policy changes materially. Each answer is deleted automatically 3 years after the consent ends, which is 4 years after the answer.

There are no advertising cookies and no social media pixels on this host.

5. Controlling and deleting them

Signing out removes the cookies of your session immediately.

You can change your banner answer at any time under "Cookie settings" in the footer of every page. Withdrawing consent stops page analytics immediately and removes its cookie and entries from your browser. Data already sent cannot be recalled.

Your browser can block or delete cookies and site data for a host, usually in the settings under privacy. If you delete the cookies, you are signed out, the banner appears again, and during the waitlist phase you have to open your access through the waitlist again. If you also delete the site data, the working data of the browser application that is held only in your browser is lost. What you have saved to your account remains.

In the browser application, "Reset this device" in the settings clears the entries with the prefix oq..

6. Questions

Send questions to info@orionquant.com.

You can complain to the supervisory authority: the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.

Section 8 of the Privacy Policy sets out this right and your other rights, and section 7 summarises this policy.