Cookie policy
A practical inventory of the cookies and browser storage used by Avioverse, with optional categories off until you choose them.
Last updated 27 September 2026
Cookies are small text records stored by your browser. Avioverse also uses similar browser storage, such as local storage and session storage. Some records are essential to sign you in, protect requests or remember a choice you made. Optional analytics or marketing storage requires your consent.
1. Cookies in use
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
| avioverse_cookie_consent | Remembers whether you accepted, rejected or customised optional categories. | 1 year | Necessary |
| __Secure-avioverse.session-token | Keeps an authenticated account signed in. In local development the same cookie is named avioverse.session-token. | Up to 30 days | Necessary |
| Authentication request cookies | Protect sign-in and sign-out requests, OAuth redirects and callback destinations. | Session or short-lived | Necessary |
| avioverse.active-workspace-id | Remembers the personal or team workspace you last selected. The server re-checks membership. | 1 year | Necessary preference |
| av_unlock | Keeps a protected audit response link unlocked after the correct passphrase or email is supplied. | 2 hours | Necessary security |
| _ga | Google Analytics — distinguishes one browser from another. | 2 years | Analytics — consent |
| _ga_<stream id> | Google Analytics — holds the state of the current visit. | 2 years | Analytics — consent |
| _clck | Microsoft Clarity — recognises a returning browser. | 1 year | Analytics — consent |
| _clsk | Microsoft Clarity — joins the pages of one visit into one replay. | 1 day | Analytics — consent |
The analytics rows are set only if you accept analytics. Reject the banner, or ignore it, and those scripts are never loaded, so none of those cookies is written. If you later withdraw analytics consent, measurement stops at once: the analytics cookies are deleted from your browser and the page reloads, so a session replay cannot keep running. Microsoft may also set its own cookies (such as MUID) on Microsoft domains while Clarity runs.
2. Optional categories
Analytics
Google Analytics 4 counts visits and page journeys on the public website after you consent, and keeps that data for 14 months. Microsoft Clarity shows us, after you consent, how pages are used: heatmaps of clicks and scrolling, and replays of visits that show where the site gets in the way. Everything you type is masked before it leaves your browser, including the early-access email field.
Google Analytics is configured with Google Signals and advertising personalisation switched off, so it measures use and does not build advertising audiences. Clarity is connected to no advertising product. Google and Microsoft process data outside the EEA under the transfer safeguards in their own terms.
Each page is reported by its address without the part after #. The only address parameters ever reported are campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content), so we can tell which link brought you here. A page whose address carries any other parameter, the sign-in and account pages, and the regulation explorer are not measured at all; opening one while Clarity is recording reloads the page without it. Analytics runs only on the public website: the Avioverse app sends nothing to Google Analytics or Microsoft Clarity, so neither receives your account identity, payment or session identifiers, workspace content, documents, records, notes or conversations.
Marketing
Avioverse sets no advertising or cross-site marketing cookies. The category exists so that any future use stays off by default and needs a specific choice, and we would name the provider here before setting one.
3. Similar browser storage
Avioverse uses non-cookie browser storage for limited product functions:
- local storage remembers the active workspace and certain interface preferences, such as theme or dismissed product guidance;
- session storage remembers short-lived interface choices, such as dismissing a public-site call-to-action for the current tab; and
- the browser may cache static files to load the Service efficiently.
These records are used to provide or remember a feature you request, not for advertising. Clearing site data in your browser removes them and may reset preferences or sign you out.
4. Legal basis and control
Strictly necessary storage is used to provide the service or feature you request and does not require cookie consent. Optional analytics and marketing storage is based on consent and stays off until you opt in. Rejecting optional storage does not block ordinary access to the website or account.
You can accept all, reject all or choose categories in the banner. You can change or withdraw the choice at any time through Cookie settings in the footer or the button above. Withdrawal does not affect processing that was lawful before it. You can also block or delete storage in your browser, although blocking necessary cookies may prevent sign-in or protected-share access.
5. Changes and contact
We will update this page before adding a new cookie provider or materially changing a purpose. Questions about cookies or related personal data can be sent to privacy@avioverse.io.