Cookies

This page lists every cookie AI Suite sets, what each one is for, how long it lasts, and what happens if you refuse it. It is written from the code that sets them, so it is a list of the cookies this application actually uses rather than the ones a product like it usually would.

If you are signed in, you do not have to take this page’s word for it. Cookies & storage in your profile shows what your own browser is holding right now, with the values, and clears the optional ones on one press.

What we do not do

There are no advertising cookies, no analytics, no measurement, no pixels and no cross-site tracking of any kind. Nothing below is used to build a profile of you or to measure you against anybody else. Two scripts do load from other companies, both to do a job on a page you are already on rather than to watch you, and they have their own section further down.

That is also why there is no consent banner. Every cookie on this page is either strictly necessary to sign you in and keep you signed in, or a preference you set yourself by using a control on a screen. A banner asking permission to remember which layout you chose would be theatre, and consent that is asked for everything means nothing when it matters. A control that shows you what is stored and deletes it is worth more than a dialogue that only knows the word yes, so that is what was built instead.

There is a notice in the corner of the sign-in and sign-up pages, and it offers one real choice rather than a yes. Choosing only what is necessary records cookie-choice and stops the six preference cookies below from being written at all, deleting any that are already there. Signing in is unaffected, because it cannot be. The same question is answerable again at any time under Cookies & storage, and nothing else changes either way: there is no advertising or analytics to switch off, so that is the whole of what a cookie choice can mean here.

Strictly necessary

These cannot be turned off, because without them there is no way to sign in or stay signed in. Refusing them means the console will not work at all.

Signing in

Set by Auth.js. In production every name below carries a __Secure- prefix, except the CSRF token, which carries the stricter __Host-. All of them are httpOnly, so no script on the page can read them, sameSite=lax, and secure wherever the site is served over HTTPS.

• authjs.session-token is the session. It holds a signed token carrying your user id and how you authenticated, and nothing else: no name, no email, no permissions, because those are read from the database on every request. It lasts eight hours and is not extended by activity.
• authjs.csrf-token holds a random value that lets the server tell a form you submitted from a form somebody else submitted on your behalf. It lasts as long as the browser is open.
• authjs.callback-url holds the page you were trying to reach when you were asked to sign in, so you land there afterwards rather than on the dashboard.
• authjs.pkce.code_verifier and authjs.state are set only while a Google sign-in is in flight, last fifteen minutes, and exist so the answer coming back from Google can be checked against the request that went out. If you sign in with a password they are never set.

webauthn-register-challenge and webauthn-authenticate-challenge

• What they hold.A single random challenge for one passkey ceremony, so the browser’s answer can be checked against the question that was actually asked.
• How long. Five minutes, and they are deleted the moment the answer arrives, whether or not it verified, so a captured challenge cannot be replayed.
• Flags. httpOnly, sameSite=lax, secure in production.
• Only if you use passkeys. If you sign in with a password these are never set.

Preferences

These are set only when you change something, and they hold a setting rather than an identifier. Blocking or deleting them costs you nothing except that the screen forgets what you chose and goes back to its default. None of them is read by anybody but your own browser and the page it is drawing.

• gen-layout holds whether a generative page shows its results as a grid or a single frame.
• gen-columns holds how many columns that grid has.
• gen-upscale-scale holds the upscale factor you last used.
• gen-video-speed holds the video speed you last chose.
• panel-open holds whether the property panel on the right of the console is open or shut.
• sidebar_state holds whether the sidebar is open or collapsed.

The first five last a year; the sidebar one lasts a week. All are sameSite=lax and none is httpOnly, because the page that reads them is the page you are looking at.

Two scripts that are not ours

Both run in your browser, on one page each, and both are there to do something you asked for. Neither is an advertising or analytics tag. Because they are somebody else’s code, they are able to set cookies of their own that we neither set nor read, and we will not print a list of those here: it would be a guess about another company’s software, and a guess is exactly what this page exists to avoid.

• Cloudflare Turnstile, on the sign-up form only. It tells a person from a script, so that registrations are people. It receives a one-time token and your IP address. Cloudflare is listed as a Data Processor in the Privacy Notice.
• Razorpay Checkout, loaded only when you press to buy a plan, and not before. It draws the payment form, which is why your card details are typed into their page and never reach us. Razorpay is listed as a Data Processor in the Privacy Notice.

Nothing else loads from another domain. There is no tag manager, no session recorder and no third-party font.

Not cookies: your browser’s own storage

These are kept in your browser’s local storage rather than in a cookie, which means they are never sent to the server. They are listed here because they are the same kind of thing and you should be able to find all of it in one place. Four of them hold work of yours that has not been saved anywhere else, so clearing them loses that work.

• theme holds whether you chose light, dark or your system setting.
• story-drafts:<you> holds unsaved story drafts.
• story-tune:<you> holds the story settings you last adjusted.
• aisuite.story.painting.<you> holds unsaved painting state for a story.
• aisuite.workbench.saved holds requests you saved in the API workbench.

Refusing or removing them

Cookies & storage in your profile lists everything above as your own browser currently holds it, and clears the preferences and the browser storage without touching your session. It is the honest version of a cookie banner: it comes after the fact, but it can actually delete something.

Every browser can also block cookies for a single site and delete the ones already stored, usually under Settings, then Privacy. Deleting the preference cookies is harmless. Deleting or blocking the sign-in cookies signs you out and prevents you signing back in, so the console becomes unusable rather than degraded.

If this list changes

Adding any cookie that measures, profiles or follows people across sites would require this page to be changed and your consent to be asked for before it is set. Nothing described here is a placeholder for that: the absence above is a statement about how this product is built, not an omission waiting to be filled.

What is held about you beyond cookies, meaning your account, your prompts, what you generate and how long any of it is kept, is set out in the Privacy Notice.