Cookies and similar technologies

The short version

Affinira's own code sets seven families of cookie, and which of them a site can set depends on how it was set up. Two evaluation cookies — a client-area sign-in for local review and a saved profile snapshot — depend on one switch that is off whenever the platform reports Vercel. An administrator sign-in cookie is set only where the administrator console is configured, and only when an administrator signs in to it. Separately, where a site is set up for accounts, signing in sets the account session cookies the sign-in provider needs, and each request to the account area refreshes them; they hold a session and nothing about you beyond it. Before any sign-in, asking for a confirmation or reset email sets one short-lived verifier cookie the provider needs to complete that link when it comes back. Where the site holds the secret that brings a confirmation or reset link back here, short-lived cookies of Affinira's own are set on those journeys and nowhere else: a signed pending sign-up marker holding the address this browser just signed up with, so that asking for a new confirmation email needs nothing typed, and, on the live account service, a signed recovery marker bound to you and to the session a reset link established, which is what authorises choosing a new password; a signed pending paid marker holding the email address and Pro or Ultra plan choice for up to one hour while you enter a code; a signed paid link marker holding the plan choice and account ID for up to five minutes after a verified link callback; a signed pending ambassador marker holding the entered email address and invitation hash for up to one hour while you enter a code; and, when you sign up after picking Pro or Ultra on the pricing page, a cookie holding that plan choice and your account ID, kept for up to 30 days, so Billing can offer to finish checkout if you leave it (it authorises nothing, and it is removed when you sign out or dismiss the offer); all are first-party, strictly necessary for those journeys, and expire on their own. When you open an ambassador invitation link with invitations enabled, an HttpOnly cookie keeps that link through email verification or sign-in in this browser. It expires after 14 days and is removed when you accept or dismiss the invitation. When you choose Start a team on the pricing page and are not signed in, an HttpOnly cookie keeps the billing period and seat count you picked while you create an account or sign in. It holds nothing else, buys nothing, expires after one hour, and is removed when checkout opens or you sign out. When you open a data download link from our email while signed out and choose Sign in, an HttpOnly cookie keeps that link while you sign in, so you come back to it. It is sent only to your account pages, expires after 15 minutes, and is removed as soon as you are back. When a team admin connects a CRM (Zoho or HubSpot), we set one short-lived cookie that links the CRM's reply back to that admin. It is strictly necessary, sent only to the return address, and deleted on return or after 10 minutes. When you connect Claude or ChatGPT to your account, we set one cookie that ties the connection request to the browser you started it in, so it can be approved only there. It is strictly necessary and expires after an hour. When you open Affinira from the Android app, one cookie records that, so purchase options are hidden in the app. It holds nothing else and lasts up to 400 days, renewed while you use the app; a page of Affinira opened in Chrome on the same phone clears it. To tell the two apart, the app's own tab keeps a marker in its sessionStorage (the value 1, nothing else), which is discarded when that tab closes and is never sent to us. If your Android app can offer more choices for the card on your lock screen, it tells us when it opens, and a cookie records that, so the QR page shows those choices only in an app that can use them. It holds nothing else. It lasts up to 180 days, is renewed each time the app opens, and is removed when an older version of the app opens Affinira. In the Android app, a cookie holds a random code tied to your account (not your name or email), so the app can open your saved screens instantly and never show them to another account. It is deleted when you sign out, and saved screens are not used after 7 days without a connection. If you sign out while offline, a cookie remembers it, so you are also signed out on our side as soon as you are back online. It holds nothing else and is removed once that is done. When you open a website page from the Android app and the website needs your go-ahead to sign you in, we set a short-lived cookie that links your answer to that request. It holds a one-time reference to the request and your app account's email address, encrypted. It is strictly necessary and is deleted once you answer, or after 10 minutes. When you sign in with a passkey, or add one in Settings, we set a short-lived cookie that links your device's answer to the request you started in this browser. It holds a one-time reference to that request (and, when you add a passkey, your account ID). It is strictly necessary and is deleted once the answer arrives, or after 5 minutes. That switch checks for Vercel and nothing else: it does not detect a local machine, and it would not by itself stop these cookies being enabled on some other host. So this describes the configuration the site is built for, not a guarantee about every environment. What follows describes Affinira's own code; it does not describe cookies the hosting platform may set in front of the site, which we have not enumerated here. It offers exactly one optional technology — Vercel Web Analytics, a cookieless page-view counter — and it loads only if you affirmatively accept it. Rejecting it, or simply never answering, loads nothing. The one thing stored before anything else can run is your consent choice itself, in your browser's localStorage, because that is how "no" stays "no".