Cookie Policy

Effective Date: September 5, 2026Version 3.0

1. What Are Cookies?

Cookies are small text files a website stores on your device. We also use two related browser features — localStorage and sessionStorage — which work similarly but are read only by the page itself and are never sent to our servers.

This page lists everything we set. It is a complete inventory, not a representative sample.

2. How Autometa Uses Them

Strictly necessary: keeping you signed in, renewing your session, protecting the sign-up and login screens from automated abuse, and remembering your cookie choice. The product cannot function without these.
Functional: small conveniences such as remembering that you have visited before. These are stored in your browser and never leave it.
Non-essential: session replay by our error-monitoring provider, which we use to reproduce faults. This is the only category that requires your consent, and declining it stops the recording.

No advertising or cross-site tracking. We set no third-party advertising cookies, run no behavioural ad pixels, and do not monetise your browsing history. We do not currently run any product-analytics tool.

3. Cookie Inventory

Cookie Name	Type	Purpose	Duration
`token`	Essential	Short-lived access token that authenticates your requests to the API. HTTP-only, so it cannot be read by scripts.	15 minutes
`refreshToken`	Essential	Renews your access token so you are not signed out every few minutes. HTTP-only and rotated on each use.	7 days
`adminToken`	Essential	Authenticates a session in the internal administration console. Only ever set for our own operators.	Session
`partner_refresh`	Essential	Renews the session for referral partners signed in to the partner portal. HTTP-only.	Session
`crm_cookie_consent`	Essential	Records whether you accepted or declined non-essential storage, so we stop asking and can honour your choice.	365 days
`crm_visited`	Functional	Notes that this browser has visited before, so the landing screen does not repeat first-run content.	365 days

Authentication cookies are HTTP-only, restricted to our own domain, and marked Secure in production. Your access and refresh tokens are never copied into storage that JavaScript can read.

4. Browser Storage

Inside the application we use localStorage for interface preferences — your saved cookie choice, theme, and similar per-browser conveniences — and sessionStorage to carry a referral code across the sign-up steps so a page refresh does not lose it. None of this is transmitted to us or shared with anyone.

5. Third-Party Scripts

These are the only third-party scripts our pages load, and what each does:

Provider	Purpose	Category
Google reCAPTCHA	Distinguishes real users from automated sign-up and login attempts. Loads on the authentication screens and sets cookies on Google domains.	Essential (security)
Cloudflare Turnstile	The same protection on public lead-capture forms.	Essential (security)
Sentry	Captures error reports, and records a sample of application sessions as replays so faults can be reproduced. Text is masked and media is blocked. Not started if you decline non-essential storage.	Non-essential (consent)
Firebase Cloud Messaging	Registers a service worker so the application can deliver push notifications, if you enable them.	Functional (opt-in)

reCAPTCHA is provided by Google and is subject to the Google Privacy Policy and Terms of Service.

6. Managing Your Preferences

When you first open the application you are asked whether to accept non-essential storage. Choosing Essential Only stops session replay from starting; everything in the strictly-necessary table above still applies, because without it you cannot stay signed in. Your choice is stored for a year and you can change it by clearing site data.

Your browser also lets you block or delete cookies for any site. Blocking our strictly-necessary cookies will prevent you from logging in at all.

For questions about our cookie practices, email privacy@autometa.in, or see the Privacy Policy.