1code Studio Cookie Policy
Last updated: 30 October 2026 · Version 1
We use only the cookies 1code needs to work. Some keep you signed in and keep sign-ins safe. One remembers whether you chose the day or night look. Our apps also keep a few of your choices in your browser. We count views of shared videos without storing anything on your device. We use no advertising cookies, and nothing follows you across other websites. You can delete or block all of them in your browser, but if you block the sign-in cookies you cannot sign in. The first part of this policy applies to everyone. The country sections after it add only what is different or extra where you live.
Who we are
1code Studio is run by 1CODE X LTD, a company registered in England and Wales (company number 12828341), at 2 Centurion Way, Credenhill, Hereford HR4 7FF, United Kingdom. We decide which cookies 1code uses and why, for everyone, wherever you live.
What this policy covers
This policy covers:
- 1code.studio and all its addresses, such as app.1code.studio and calendar.1code.studio;
- 1code.co.za and 1code.uk;
- 1code ID (1code.id);
- 1code Mail (1code.email);
- free sites at
<name>.1code.host; - the 1code phone app.
Our Privacy Policy explains everything else we do with your information.
Cookies and local storage
A cookie is a small piece of text that a website keeps in your browser and reads when you come back. Local storage is a similar store in your browser. Only the page itself can read it, and it is not sent with each visit. This policy covers both.
The cookies we use
All our cookies are our own. No advertising, analytics or social-media company sets cookies through our pages.
| Cookie | What it does | How long it lasts |
|---|---|---|
| Sign-in | Keeps you signed in. It holds a signed token, never your password. | Up to 30 days, or until you sign out. On 1code ID, a few hours. |
| Sign-in step | Protects a sign-in while it is happening, so no one else can finish it. | 10 minutes |
| Shared link | Holds the access that a shared room or document link gives you, so the link's secret does not stay in the address bar. | Up to 12 hours |
| Signed-in marker | Tells a page that you are signed in, or have just signed out, so it shows the right screen. It holds nothing about you. | 30 seconds to 30 days |
Day or night (onecode-theme) | Remembers whether you chose the day or night look. It holds only the word light or dark, and is set only when you press the day/night switch. | 1 year from your last change |
Most of these cookies are host-only: only the address that set a cookie can read it. Two are shared by every 1code.studio address:
- one sign-in cookie, so you sign in once;
onecode-theme, so your day or night choice follows you from app to app.
Our other addresses (1code.co.za, 1code.uk, 1code.id and 1code.email) keep their own copies. Sign-in cookies travel only over secure (HTTPS) connections.
What our apps keep in your browser
- Your choices: a copy of your day or night choice, your language, the last tab you opened, list or grid view, which country section you last read on our policy pages, and similar settings.
Local storage is not sent to us. It stays until you clear it.
When you watch a video that someone has shared through 1code, we count the view without storing anything on your device.
What we do not use
- No advertising or marketing cookies.
- No cookies, pixels or tags from advertising, analytics or social-media companies.
- Nothing that follows you across other websites, and no fingerprinting of your device.
- We do not sell or share what our cookies hold.
Our hosting provider, Cloudflare, counts visits to our pages from its own server records, without scripts or cookies in your browser, and without identifying you.
Cookies set by others
- Paying. You pay on Paystack's page (South Africa) or Stripe's page (everywhere else). They may set their own cookies there, for example to prevent fraud, under their own policies. Payments happen on their own hosted pages, so no payment cookies are set on our pages.
- Services you connect. When you connect Google, Slack or another service, you sign in on that service's own pages, under its cookies.
- Websites and stores built on 1code. We set only the cookies a site needs to work. A store's cart cookie (
vs_cart_<store>) holds only a random cart number for 14 days; the cart itself is kept by us. While a store's owner previews or edits their own site, two short preview cookies (vshop_owner, 4 hours, andvk_draft, 30 minutes) are used. All of these are strictly necessary, set only on that site's own address and not readable by scripts. If a site's owner adds other tools, such as their own analytics, the owner is responsible for those cookies and for asking you first where the law requires it. - Security. If security checks are on for one of our addresses, Cloudflare may set a short security cookie (such as
__cf_bm, 30 minutes) to tell people from bots. This is strictly necessary to keep the service safe.
The phone app
The 1code phone app does not use browser cookies. Your 1code ID key stays in your phone's secure hardware, and your settings stay in the app's own storage on the phone. If you allow notifications, the app keeps a notification token from Google Firebase on your phone, so we can send them to you. Turning notifications off or removing the app ends this. If the app shows a 1code web page, that page uses the cookies above.
How to control them
- Sign out to remove the sign-in cookies on that address.
- Press the day/night switch to change your choice. Delete the
onecode-themecookie to go back to the default. - Use your browser's settings to see, delete or block cookies and site data for any of our addresses. If you block sign-in cookies, you cannot sign in. Clearing site data resets your choices.
- On your phone, clear the app's data or remove the app.
Changes to this policy
When we change this policy, we change the date and version at the top. We tell you by email or in 1code at least 30 days before a significant change applies. We record which version you accepted, and in which country. If we ever want to use a cookie that needs your consent, we will update this policy and ask you before we use it.
Contact
1CODE X LTD, 2 Centurion Way, Credenhill, Hereford HR4 7FF, United Kingdom.
- Privacy, security, reports of abuse or illegal content, appeals and authorities: privacy@1code.email
- Help, billing and complaints: support@1code.studio
By country
South Africa
- Who is responsible. Under the Protection of Personal Information Act, 2013 (POPIA), 1CODE X LTD is the responsible party. 1code X (Pty) Ltd (registration number 2025/981275/07, 2 The Circus St, Three Rivers, Vereeniging 1935, South Africa) is the company South Africans contract with and pay. It does not decide how cookies are used.
- Personal information. A sign-in cookie is tied to your account, so POPIA applies to it. We use it only to keep you signed in and safe, because the service you asked for needs it (section 11(1)(b)). We count views of shared videos without storing anything on your device.
- Outside South Africa. What these cookies hold is stored by Cloudflare in Western Europe. We send it there under POPIA section 72, as our Privacy Policy explains.
- Your rights and complaints. You may ask what we hold, and ask us to correct or delete it. Our Information Officer, Thebe Phele, director of 1code X (Pty) Ltd and of 1CODE X LTD, answers at privacy@1code.email. You may complain to the Information Regulator (inforegulator.org.za).
- Nothing in this policy limits your rights under the Consumer Protection Act, 2008 or the Electronic Communications and Transactions Act, 2002.
United Kingdom your region
- The cookie rule. The Privacy and Electronic Communications Regulations 2003 (PECR) say a website may store or read information on your device only with your consent, unless it is strictly necessary for a service you asked for. Our sign-in, sign-in step, shared link and marker cookies, a site's shopping cart, and the security cookie when security checks are on, are strictly necessary. The day/night cookie and the choices in local storage only remember choices you make in the apps. These need no consent, so we do not show a cookie banner.
- Counting views. We count views of shared videos without storing anything on your device.
- Data protection law. Where a cookie holds personal information, the UK GDPR and the Data Protection Act 2018 apply, and 1CODE X LTD is the controller. Our lawful bases are our agreement with you for sign-in cookies (Article 6(1)(b)), and legitimate interests for security (Article 6(1)(f)). You may object to any use based on legitimate interests.
- Complaints. Please tell us first. You may complain to the Information Commissioner's Office (ico.org.uk).
European Union
- The cookie rule. Article 5(3) of the ePrivacy Directive, as each EU country has written it into its own law, sets the same rule: consent first, unless a cookie is strictly necessary for a service you explicitly asked for. Our sign-in, sign-in step, shared link and marker cookies, a site's shopping cart, and the security cookie when security checks are on, are strictly necessary. The day/night cookie and the stored choices only remember choices you make. These need no consent.
- Counting views. We count views of shared videos without storing anything on your device.
- Data protection law. Where a cookie holds personal information, the GDPR applies. 1CODE X LTD is the controller, on the same lawful bases as in the United Kingdom section. We will appoint and name our EU representative under GDPR Article 27 before we market to people in the EU. You may complain to the data protection authority where you live or work.
Everywhere else
- We use the same cookies everywhere, as described above.
- We do not sell or share personal information from cookies, and we do not use cookies for targeted advertising. Because nothing follows you across sites, a Do Not Track or Global Privacy Control signal has nothing to switch off.
- Where your local law gives you more rights over cookies, you have them. Write to us at the contact address above, or complain to the data protection authority in your country.