Cookie & Local Storage Policy

1What we store#

Cookies:

• Auth hint cookie (auth_hint) — a flag set to 1 that tells the app you have a session, so it can attempt a silent refresh. Contains no personal data. Kept for 7 days or until you sign out.
• Refresh-token cookie (refresh_token) — an httpOnly, Secure, SameSite=Strict cookie sent only to the refresh endpoint of our API, used only to renew your session. Valid for 7 days or until you sign out.
• Sign-in security cookies (oauth_nonce, calendar_oauth_nonce, enrichment_oauth_nonce) — httpOnly, Secure cookies that last 10 minutes. They are set only while you sign in with Google or Microsoft or connect a calendar or CRM, and they stop a forged return from the provider.
• Region and language cookies (aoe_region, aoe_locale) — the country shown in the footer, first taken from the country your connection comes from, and the language you last picked, so the site opens in it. They hold only a two-letter code each and are kept for a year. The region does not change prices or the currency you are charged in.

Session storage (cleared when you close the tab):

• aoe_session — your short-lived access token and basic profile (name, email, plan), so you stay signed in within a tab. It expires after 15 minutes and is renewed silently.
• aoe_next, aoe_expired — one-time flags that return you to the page you wanted after signing in, and tell you if your session ended.
• aoe_coach_session:… — only on the Live Coach phone page: the meeting-bound access token from the QR code, so a reload keeps the coach open. It stops working when the meeting ends.

Local storage (stays until you clear it):

• aoe_cookie_notice_ack — that you dismissed the cookie notice.
• aoe_privacy_optout — your "Do Not Sell or Share" choice on this device.
• aoe-theme, aoe-sidebar — your light/dark theme and whether the sidebar is collapsed.
• aoe_last_selection_v2, aoe_bots_seen_at — the bot settings you chose last time and when you last looked at your meetings list.
• aoe_mic_consent_ack — that you confirmed you will notify people before browser-microphone capture.
• aoe:done:… — which action items you ticked in a report.
• aoe_analytics_consent — your analytics choice (accepted or declined).

Only if you accept analytics (not set otherwise):

• ph_…_posthog (local storage) — an anonymous visitor ID and, once you sign in, your internal account ID, used by our product-analytics provider PostHog (EU region) to count named product events. No cookie is set, and no page text, form input, meeting link or meeting content is recorded; there is no session recording.
• aoe_an_… (session storage) — flags that stop the same event being counted twice in one tab.

The site language comes from the web address, not from a cookie. When you go to Stripe (checkout, billing portal), Google or Microsoft (sign-in), those companies may set their own cookies on their own pages; see their policies.

2Legal basis#

These are strictly necessary for a service you have requested (to authenticate you, keep you signed in and remember settings you chose), so we treat them as not requiring prior consent under the ePrivacy Directive. Product analytics is not necessary, so it is opt-in: nothing is loaded or stored until you press "Accept analytics" in the notice, declining is as easy as accepting, and a Do-Not-Track or Global Privacy Control signal from your browser is treated as a decline. You can withdraw consent at any time (below).

3Managing cookies#

You can clear cookies and site storage in your browser settings; doing so will sign you out. Blocking the strictly-necessary cookies will prevent the app from working. Questions: [email protected].