Who this covers
ValiqAI ("we", "us", "our") operates the ValiqAI service at valiqai.com. This Cookie Policy explains how we use cookies and similar technologies when you visit the site or use the product.
It should be read with our Privacy Policy, which describes the personal information we collect and why, and our Subprocessors list, which names the vendors that may process data on our behalf. Scan-time AI providers do not receive cookie identifiers or your private account data; they receive data from the site you test, such as its pages and screenshots. Questions: abhi@valiqai.com.
What are cookies and similar technologies?
Cookies are small text files a site stores on your device. They can keep you signed in, protect a login flow, or remember a choice.
We also use similar technologies that are not cookies: localStorage, sessionStorage, IndexedDB, and a locally generated device fingerprint. Those can persist a preference or identifier even when no HTTP cookie is set. This policy covers all of them.
How we use them
Authentication. Auth.js (NextAuth) cookies keep you signed in and protect OAuth sign-in with Google, GitHub, or SSO.
Preferences. Theme, density, last organization, and a few UI flags are stored in localStorage or sessionStorage, not in cookies.
Security. A device fingerprint in localStorage helps us detect abuse. Auth cookies use HttpOnly, Path=/, SameSite=Lax, and Secure in production.
We do not set advertising cookies, we do not run a third-party product-analytics cookie (no Google Analytics, PostHog, Mixpanel, or similar), and we do not sell your data. Page, browser, IP, and referral information described in the Privacy Policy may still appear in server logs. That is not an advertising pixel.
Categories
Essential
Required for the service to work: sign-in, CSRF protection, OAuth, and remembering your cookie-banner choice. You cannot use a signed-in account without these.
Preference
Theme, density, last workspace, and similar UI state. These are stored locally on your device. They are not advertising identifiers.
Security
Device fingerprinting used to reduce abuse (for example, repeated fake accounts or automated sign-up). This runs in the app so we can protect the service.
First-party cookies we set
These are set by ValiqAI on our domain via Auth.js. In local development the name starts with authjs. In production over HTTPS the same cookie is prefixed with __Secure-. Auth cookies are HttpOnly (not readable by page JavaScript), Path=/, SameSite=Lax, and Secure when we serve HTTPS.
First-party cookies set by ValiqAI
Name
Purpose
Duration
Category
Name
Purpose
Duration
Category
Name
Purpose
Duration
Category
Name
Purpose
Duration
Category
Name
Purpose
Duration
Category
Name
Purpose
Duration
Category
| Name | Purpose | Duration | Category |
|---|---|---|---|
| authjs.session-token __Secure-authjs.session-token | Keeps you signed in after you authenticate. This is a JSON Web Token session cookie. | Up to 30 days | Essential |
| authjs.csrf-token __Secure-authjs.csrf-token | Protects sign-in and other Auth.js requests against cross-site request forgery. | Session | Essential |
| authjs.callback-url __Secure-authjs.callback-url | Remembers where to send you after sign-in completes. | Session | Essential |
| authjs.pkce.code_verifier __Secure-authjs.pkce.code_verifier | Proves the OAuth login belongs to this browser (PKCE). Set only during Google, GitHub, or SSO sign-in. | 15 minutes | Essential |
| authjs.state __Secure-authjs.state | Stops login CSRF during OAuth. Set only during Google, GitHub, or SSO sign-in. | 15 minutes | Essential |
| authjs.nonce __Secure-authjs.nonce | Binds the OpenID token to this sign-in attempt. Set during OpenID flows such as Google. | Session | Essential |
OAuth helper cookies (PKCE, state, nonce, callback URL) appear only while a sign-in is in progress. The session cookie is set after you successfully authenticate.
Similar technologies (not cookies)
Most preference and consent storage is localStorage, not a cookie. Browser tools that "block cookies" may not clear these keys. Clearing site data for valiqai.com removes them.
Local storage and similar technologies used by ValiqAI
Name
Where
Purpose
Category
Name
Where
Purpose
Category
Name
Where
Purpose
Category
Name
Where
Purpose
Category
Name
Where
Purpose
Category
Name
Where
Purpose
Category
| Name | Where | Purpose | Category |
|---|---|---|---|
| valiqai_cookie_consent | localStorage | Stores Accept or Decline so the banner does not reappear on every page load. | Essential |
| valiq-theme | localStorage | Remembers light, dark, or system color theme. | Preference |
| valiq-density | localStorage | Remembers compact, comfortable, or spacious layout density. | Preference |
| valiqai_active_org | localStorage | Remembers the last organization you were working in. | Preference |
| valiq_device_fp | localStorage | A device identifier generated locally with FingerprintJS (open source). Used to detect abuse and multi-account fraud. It is not sent to Fingerprint.com. | Security |
| valiq_welcome_dismissed, valiqai:authMode, valiqai:tempEmailAcknowledged, pendingScanUrl, valiqai_org_prompt_dismissed | localStorage / sessionStorage | Short-lived UI state: dismissed welcome cards, auth-screen mode, pending scan URLs entered before sign-in, and organization intro prompts. | Preference |
Third-party cookies and requests
We do not use third-party advertising cookies. Other companies may set cookies on their domains when you use a feature that sends you there, or when their script runs on our site.
Third parties that may set cookies or similar storage
Party
When
What they may set
Party
When
What they may set
Party
When
What they may set
| Party | When | What they may set |
|---|---|---|
| GooglePrivacy policy | If you sign in with Google. You leave ValiqAI and authenticate on accounts.google.com. | Google cookies on google.com / accounts.google.com, governed by Google. |
| GitHubPrivacy statement | If you sign in with GitHub. You authenticate on github.com. | GitHub cookies on github.com, governed by GitHub. |
| StripePrivacy policy | If you start checkout for a paid plan or credits. Checkout runs on Stripe hosted pages. | Stripe cookies on checkout.stripe.com (fraud prevention and completing payment). |
Vendors that process data for us (including Stripe) are listed on the Subprocessors page.
How long they last
Session cookies are deleted when you close the browser. Persistent cookies (the session token, up to 30 days) remain until they expire or you delete them. localStorage keys remain until you clear site data for valiqai.com, or the app overwrites them. Durations for each item are in the tables above.
Your choices
On your first visit we show a banner with Accept and Decline. Your choice is stored in localStorage under valiqai_cookie_consent. The Cookie Preferences link in the footer clears that value and reloads the page so the banner appears again.
We do not currently load extra optional analytics cookies if you click Accept. Decline records that you do not want optional cookies and hides the banner. It does not disable:
Auth.js cookies needed to sign in and stay signed in
Preference keys in localStorage (theme, density, workspace)
Device fingerprinting used for abuse prevention
Those run because we use them to operate, secure, and debug the service. There is no separate in-product toggle for fingerprinting today. If we add optional analytics cookies later, we will update this policy and ask again where required.
You can also block or delete cookies in your browser:
Do Not Track & Global Privacy Control
Some browsers send a Do Not Track (DNT) signal. There is no single standard for DNT, so we do not change behavior based on it. Some browsers also send Global Privacy Control (GPC). We do not sell personal information or share it for cross-context behavioral advertising, so there is no ad-sharing to turn off. GPC does not currently disable essential cookies or fingerprinting. You can still use Cookie Preferences and your browser controls.
If you disable cookies or site data
If you block or delete Auth.js cookies, you will be signed out and may be unable to complete Google, GitHub, or SSO login. Clearing localStorage resets theme, workspace memory, consent, and the device fingerprint (a new fingerprint may be created on the next visit). Blocking only third-party cookies typically still allows first-party auth cookies to work, but Google, GitHub, or Stripe checkout may fail.
Changes to this policy
We will update this page when the cookies or similar technologies we use change, and we will change the "Last updated" date at the top. For material changes we will ask for a new choice where that is appropriate.
Questions?
Contact us at abhi@valiqai.com.