Cookie Policy
This policy explains the cookies and similar technologies used across CodeOn's systems. It covers this website (the marketing site at codeon.lk), the client area at billing.codeon.lk where you order and manage billing, and the control panel at control.codeon.lk where you manage servers.
1. The public website (this site)
What follows can be checked directly against the code of this website:
- The marketing site sets no cookies of its own. It runs no analytics scripts, no tracking pixels, no advertising technology, and stores nothing in your browser.
- It does load four kinds of external material: web fonts from Google Fonts, images from a public content-delivery network, the Trustpilot reviews widget on the home page (a small script from widgets.trustpilot.com that displays CodeOn's public Trustpilot reviews in an embedded frame), and the directory listing badges in the footer (Twelve Tools and WHTop). Serving those requests necessarily involves your IP address and standard browser information being seen by those networks' servers, the same way every external asset request works. That is a request-log matter on their side, not a cookie placed on your device by us.
2. The client area and control panel
Systems you log into need session management to function safely. The client area and control panel are expected to use functional cookies and similar browser storage for:
- Session cookies keeping you logged in between page loads;
- Security tokens protecting forms against cross-site request forgery;
- "Remember me" persistence where that option is offered at login;
- Shopping flow state in the client area (keeping a cart or checkout between steps).
These are functional session tools, not tracking. They exist only for the duration of your interaction with those systems (plus whatever persistence a "remember me" option provides).
Named cookies as currently configured: Cloudflare, which fronts every codeon.lk
subdomain, sets __cf_bm (bot and security management, around 30 minutes) and may
set cf_clearance (challenge clearance, up to a year) — see Cloudflare's own
cookie documentation. The control panel (control.codeon.lk) runs the Pterodactyl panel, which
sets pterodactyl_session (your login session) and XSRF-TOKEN
(cross-site request forgery protection) for the session duration. The client area
(billing.codeon.lk) sets its own login-session cookie and matching security token, with
durations following your "remember me" choice at login.
3. What we do not do
- No advertising cookies, no cross-site trackers, no profile building for marketing.
- No third-party analytics on this site.
4. Discord and other platforms
Our community lives on Discord, which is operated by Discord Inc. under its own terms and privacy arrangements; if you join it, Discord's own policies apply, not this one. We cannot verify from here what Discord sets in your browser, and we make no claims about it either way. The same applies to payment pages hosted by payment providers at checkout.
5. Controlling cookies
- Your browser gives you control over cookies: you can clear them, block them per-site or entirely, and use private browsing. Blocking session cookies entirely will stop the client area and control panel from staying logged in — functional session storage is part of how those systems work safely.
- Because this public site sets no cookies of its own, there is nothing to opt out of here.
6. Questions
Questions about cookies follow the routes on the Contact & Support page — the Discord community, client-area tickets, or email to support@codeon.lk.