Cookie Policy

Effective 2026-10-20

This policy describes the cookies and similar storage used by ChameleonUI.io, the Chameleon website operated by Materia Technologies, Inc. ("Materia", "we", "us"). It covers the website only. Your rights in the Chameleon software itself are set out in the Chameleon Software License Agreement, published at https://ChameleonUI.io/legal#chameleon-software-license-agreement.

Table of Contents

1. What we use, and what we do not

We set no advertising cookies, no analytics cookies, and no tracking cookies of any kind. We do not use Google Analytics or any comparable product, we run no advertising, we operate no tracking pixels, and we sell no data to anybody. Nothing on this site profiles you, and nothing follows you to another site.

Most of what is described below exists so that the site can work: to carry your session between one page and the next, to complete the sign-in handshake safely, and to remember the choices you make about the rest. In the vocabulary of the ePrivacy Directive these are strictly necessary. Three further uses are optional, and happen only if you turn them on in the cookie banner (section 5): remembering your preferences, keeping you signed in after you close your browser, and keeping the live code examples' files on your device.

The site does measure, without cookies, which pages are read, how fast they are and when something breaks. What it records, and how to stop it, is set out in the Privacy Notice, published at https://ChameleonUI.io/legal#privacy-notice.

2. Cookies this site sets

Cookie Purpose Lifetime
ChameleonAuth Keeps you signed in. Written when you complete sign-in and read on every request afterwards so that you are not asked to sign in again on every page. Until you close your browser. If you turned on Keep me signed in (section 5), one day, extended while you keep using the site
.AspNetCore.Session Identifies your server-side session, which holds your access token for the duration of your visit. Until the browser is closed
chameleon-auth-hint Tells the pages whether you are signed in, and on which plan, so they show the right buttons as soon as they load. It holds one of four words (signed out, signed in, Community or Pro) and nothing that identifies you, and it cannot sign anybody in. Until the browser is closed
.AspNetCore.Correlation.* Written for a few minutes during sign-in, so that the reply from our identity provider can be matched to the request that started it. This is what prevents somebody else's sign-in from being substituted for yours. Minutes; deleted as soon as sign-in completes
.AspNetCore.OpenIdConnect.Nonce.* Written alongside the above for the same few minutes, and protects the sign-in exchange against replay. Minutes; deleted as soon as sign-in completes
eu-consent Remembers your answer to the cookie banner (section 5), including a refusal, so that you are not asked on every page. It holds which of the three optional uses you allowed, and nothing else. 180 days, then you are asked again
ChameleonOptOut Written only if you opt out of measurement under section 7 of the Privacy Notice, and remembers that you did. It holds no identifier. Thirteen months, renewed while you keep using the site

ChameleonAuth, .AspNetCore.Session and the two sign-in cookies are HttpOnly — no script on the page can read them, including ours. chameleon-auth-hint is not, because the pages read it to show the right buttons, and it holds nothing that identifies you or signs anybody in. eu-consent and ChameleonOptOut are not either, because our own script writes them when you make a choice, and our page speed script reads ChameleonOptOut to know that it must send nothing. All seven are sent only to chameleonui.io.

If you turn on Remember preferences (section 5), the site stores two values in your browser's local storage:

Key Purpose Lifetime
cws-framework Remembers whether you last read the documentation as Web Components, React or Blazor, so that code samples come back in the flavor you chose. Until you turn Remember preferences off, or clear your browser's site data
cws-color-scheme Remembers whether you chose the light or the dark appearance, so the site comes back the way you left it. Until you turn Remember preferences off, or clear your browser's site data

Each contains a single word, neither ever leaves your browser, and neither is sent to us. Without Remember preferences, your choice holds for the page you are on and nothing is stored.

If you turn on Faster live examples (section 5), the live code editor keeps its files on your device so that examples load faster next time: a service worker, Cache Storage and a browser database named chameleon-repl on this site, and a service worker and Cache Storage on the site the examples run in, sandbox.chameleonui.io. They hold the editor's own program files and nothing about you. Turning Faster live examples off deletes them from this site at once, and from sandbox.chameleonui.io the next time a live example loads.

4. Cookies set by Auth0 when you sign in

Signing in takes you to Auth0, the identity provider we use, which sets its own cookies on its own domain to run the sign-in page and to remember that you have signed in. Those cookies are Auth0's, are governed by Auth0's own policy, and are not readable by this site. You meet them only while you are on the Auth0 sign-in page.

On your first visit, a bar at the foot of the page asks what you allow. Reject all and Accept all answer for all three optional uses at once; Choose opens a panel with a switch for each of them, all starting off:

The site works fully whatever you choose. Your answer, a refusal included, is kept in eu-consent for 180 days, after which you are asked again. You can change it at any time through Cookie settings, at the foot of every page. Turning a use off deletes what it stored. You can also delete any of these cookies through your browser's settings; deleting ChameleonAuth signs you out.

The same panel holds the switch for site measurement, which is not a cookie and does not depend on this consent: it is described in section 7 of the Privacy Notice. Reject all also opts you out of measurement.

6. Changes to this policy

If we change this policy we publish the revised version on this page with a new effective date. If a change adds a new optional use, the cookie banner asks you again, since the answer you gave did not cover it. We publish a change that does not affect the substance, such as a correction to wording, without moving the effective date.

7. Contact

Questions about this policy go to chameleon@materia.tech, or to Materia Technologies, Inc., 5201 Feather Lane, Tilghman, MD 21671-1195, USA.