Translation notice. This English translation is provided for convenience only. The legally binding text is the Ukrainian original: Політика cookie.
DSTUcrypt service
Website owner: Elektronnyi Obih LLC (ТОВ «ЕЛЕКТРОННИЙ ОБІГ»), EDRPOU (company code) 46191111
Address: Ukraine, 04077, Kyiv, 1a Dniprovodska St., office 1
Contact: privacy@dstucrypt.com.ua
Revision dated: 7 August 2026
Published at: https://dstucrypt.com.ua/en/cookies
On the public pages of the website we use Google Analytics — to see how many people visit and which pages they read. We have no advertising networks, social media pixels, or cross-site tracking trackers. We do not build visitor profiles and do not pass any data about you to advertisers.
Inside the signing widget there is no analytics at all — where you work with your key, no one is watching you.
We use browser data storage technologies in four cases:
The fourth item is the most important one, and a separate Section 5 is devoted to it.
A cookie is a small text file that a website stores in your browser and receives back on subsequent requests. It is used, among other things, so that the site “remembers” that you have signed in.
Local storage (localStorage) is a browser mechanism for storing data on your device without a time limit. Unlike cookies, this data is not sent automatically to the server with every request — it stays in the browser until it is deleted.
Session storage (sessionStorage) is the same, except the data disappears as soon as you close the tab.
Why the document is named this way. In most services the main workload falls on cookies. In our case it is the opposite: the most important data is stored in localStorage and sessionStorage, while there are almost no actual cookies. That is why calling this document simply a “cookie policy” would be inaccurate.
| Name | Type | Purpose | Attributes | Duration | Required? |
|---|---|---|---|---|---|
dstu-theme | localStorage | stores the light or dark website theme you have chosen | — | until you delete it | no — but without it the theme will reset on every visit |
| Technical session cookie of the account dashboard | cookie | maintains the signed-in state of your account after you follow the link sent to your email | Secure, HttpOnly, SameSite=Lax | until the session ends or you sign out of the account | yes — without it, signing in to the account is impossible |
The account session cookie is set only after you sign in; it is not present on the public pages of the website. Our only persistent cookies are analytics ones — _ga and _ga_YZJR7K6E55 (see 3.2). They do not let us know who you are: they contain only a random browser identifier.
| Service | What it does | What data it may receive | When it appears |
|---|---|---|---|
Google Analytics (googletagmanager.com) | counts visits to the website’s pages | IP address (Google truncates it before storage), device and browser type, the page you came from and the pages you viewed; a random browser identifier in the _ga cookie with a lifetime of 2 years | on the public pages of the website; in the signing widget — never |
YouSelfBot (app.youselfbot.com) | chat widget for contacting support | technical session data; your name, contact details and message content — only if you provide them yourself | on all pages of the website |
| LiqPay (JSC CB PrivatBank) | accepting payment for the Subscription | data required to process the payment and to counter fraud, in accordance with the payment system’s rules | only on the payment page, after you proceed to payment |
Important note about YouSelfBot. Although the widget is loaded from another domain, it is a product owned by Elektronnyi Obih LLC, not a third-party service. The data of your enquiry stays within our company and is not passed to anyone. We list it separately only because, technically, it loads from the domain app.youselfbot.com, and you will see this in developer tools or a script blocker.
We do not use:
The last item is not a formality but a line we draw deliberately: the pricing page may be counted; the window where a person works with their key may not.
We load fonts from Google Fonts (fonts.googleapis.com), so your IP address becomes known to Google at that moment as well.
4.1. If you sign a document or sign in with a QES on someone else’s website, the DSTUcrypt widget loads as an isolated iframe from the domain dstucrypt.io.
4.2. Inside this iframe, no analytics or advertising technologies are used. Only what is described in Section 5 is used, and only provided that the site owner has enabled the corresponding feature.
4.3. What the website you are on uses itself is beyond our control. That is determined by its owner’s policy.
This is the most sensitive part, so we describe it in detail.
The Service has an optional feature called “Automatic Mode” (in the documentation — session). It allows you not to select the key file and not to enter the password every time you sign a document.
The feature is enabled by the owner of the integrating website, not by us and not by you. If the owner has not enabled it, no key data is stored in your browser at all.
| What | Where | How it is protected | For how long |
|---|---|---|---|
| The encrypted container of your personal key | localStorage of the domain dstucrypt.io | AES-GCM-256 encryption; the encryption key is derived from your PIN code using PBKDF2-SHA256 with 310,000 iterations | up to 30 days |
| The unlocked “key + password” pair | sessionStorage of the current tab | exists only within the open tab | for the period set by the site owner (ttlMinutes) |
| The fact that you gave consent to storage | localStorage of the domain dstucrypt.io | — | together with the container |
| Your PIN code | nowhere | — | — |
mode: 'password', only the key file is stored, while the password is requested every time and is never stored.session.forget() method);dstucrypt.com.ua (see Section 7);Do not enable key storage on devices that other people have access to — shared, work, or public computers. Encryption protects the container from being read, but it does not protect against someone who knows your PIN.
6.1. As of the date of this revision, the applicable legislation of Ukraine contains no specific rule on a cookie consent banner analogous to Directive 2002/58/EC. We are guided by the Law of Ukraine “On Personal Data Protection” No. 2297-VI, the Law of Ukraine “On Electronic Communications” No. 1089-IX as regards the protection of End User information, and by the approach established in European practice.
6.2. Allocation of grounds:
| What | Ground |
|---|---|
| Account session identifier | necessity for the provision of a service you have expressly requested (signing in to the account) |
dstu-theme | legitimate interest — ensuring interface convenience; the data is anonymised and poses no privacy risk |
| Storage of the key container | consent — given by you directly in the widget interface when setting up Automatic Mode; the fact of consent is recorded on your device. Consent can be withdrawn at any time by deleting the stored data (Section 5.5) |
| Google Analytics | legitimate interest — understanding which pages are used; anonymised visit data is collected, and we do not match it with your account. You can opt out at any time (Section 7) |
| Support widget | legitimate interest — providing support; personal data is processed only if you provide it yourself |
| Payment service | performance of the agreement and of legal requirements in the field of payment services |
6.3. There is currently no consent banner on the website: the legislation of Ukraine contains no rule analogous to Directive 2002/58/EC, and the only analytics we use counts page visits and does not profile you. If we add technologies for which consent is mandatory, or start operating in markets where such a banner is required, we will implement it and update this section.
6.4. Regardless of this, you can opt out of analytics yourself — see Section 7.
You can view, restrict, or delete cookies and site data in your browser settings:
You can also use private browsing mode — then all data will be deleted after the window is closed.
Google offers an official browser add-on that disables Google Analytics on all websites at once: tools.google.com/dlpage/gaoptout. Any script blocker works the same way. The website will not break because of this — analytics does not affect anything on it.
| You deleted | Consequence |
|---|---|
dstu-theme | the website will open with the default theme |
| the session identifier | you will be signed out of the account and will need to sign in again via a link |
| the stored key container | you will have to select the key file and enter the password again. The key itself is not lost — your original key file remains with you |
7.3. Blocking cookies and local storage at the browser level may render the account dashboard and Automatic Mode inoperable. It does not affect the ability to sign a document in the normal mode.
8.1. We update this Policy whenever the set of technologies in use changes. The current revision is always available at https://dstucrypt.com.ua/en/cookies, with the date indicated.
8.2. If we ever start using analytics or advertising technologies, we will announce this separately and introduce a consent mechanism before their launch, not after.
For questions regarding this Policy and the processing of personal data, write to privacy@dstucrypt.com.ua. For general and commercial enquiries — to sale@dstucrypt.com.ua.
Related documents:
Revision dated 7 August 2026.