What is used now
ChatWithAI uses first-party identity and security cookies needed to maintain the service you request, apply allowances and protect sign-in. The public chat does not currently use advertising cookies, third-party analytics tags, cross-site tracking or device fingerprinting. Guest identity uses a signed cookie rather than treating an IP address as your identity.
| Cookie or category | Purpose | Lifetime |
|---|---|---|
cwai_guest | Signed guest identity, conversation ownership and reply allowances | Up to 30 days. Server-side guest content has a shorter retention period. |
cwai_active_chat (session storage) | Remembers the selected chat or New/Temporary chat mode so refreshing restores the requested view. No message text or sign-in token is stored. | Until the browser tab closes, or you change the selection. It does not extend server-side chat retention. |
cwai_admin | Approved administrator sign-in | 8 hours, or until sign-out/revocation |
better-auth.session_token / __Secure-better-auth.session_token | Customer account authentication, when customer sign-in is enabled | 7-day session; may renew through active sign-in |
| Short-lived authentication state or verification cookies | Protect an enabled sign-in flow and prevent forgery | Transient; browser expiry applies to the enabled flow |
Customer email sign-in is available in the public preview. Google sign-in is not enabled. Development-only test cookies are not available on the production service. Administrator email-link tokens are stored as hashes on the server and are not advertising cookies.
Local storage and visitor summaries
Message content and account preferences are stored on the application server, not in browser local storage. Session storage remembers only the selected chat identifier or New/Temporary chat mode for this tab, so a refresh can reopen the same saved chat. Temporary conversations are not restored. Unsaved draft text lives in the current page and can be lost if you reload. Guest history still expires after 24 hours; remembering its identifier does not extend that period.
The admin visitor report summarises existing server access logs into daily request, browser/bot, coarse device and referrer-host counts. It does not set an analytics cookie or fingerprint devices. Raw server logs can contain IP addresses and browser information; derived summaries omit IPs and raw user agents. See the Privacy notice.
Cookie choices
No optional-cookie “accept all” banner is shown because no optional advertising or analytics cookies are currently deployed in the chat. The stated essential purposes still require a proportionate privacy and PECR assessment. If optional storage is introduced, we will explain it and obtain consent where required before it is used, with an equally accessible refusal or withdrawal option.
You can block or remove cookies in your browser settings and sign out of an account. Blocking identity or authentication cookies can prevent history, sign-in and allowance controls from working. Cookie expiry is different from deleting server-side records; use Settings or contact us for a data request.
Other services
Google sign-in, Stripe Checkout and webmail may use their own cookies on their own websites if you choose to open those services. Their notices apply there. This notice covers the ChatWithAI application; it does not give consent on their behalf.