Legal · Cookies
Cookie Policy
Which cookies and browser storage Interactive Media Solutions S.R.L. (IMS SRL) uses on codai.ro, hub.codai.ro, pay.codai.ro, docs.codai.ro and auth.codai.ro, and why none of them needs your consent.
Version 1.6 · Updated November 15, 2026
Summary in plain words
- We only use cookies and storage that are strictly necessary: to sign you in securely, to take payments safely, to stop bots and to remember the language and theme you chose.
- No advertising, tracking, profiling or analytics cookies. Visits to codai.ro and hub.codai.ro are counted with our own self-hosted, cookieless Umami, which sets no cookie and stores nothing in your browser.
- Because everything here is strictly necessary (Law 506/2004 art. 4(5), ePrivacy Directive art. 5(3)), we do not show a cookie banner. If we ever add a cookie that needs consent, we will ask first.
01Cookies we set
Every cookie below is strictly necessary for a service you asked for. `<app>` is the name of the site (web, hub or pay). On plain-HTTP development builds the `__Host-` prefix is dropped.
| Name | Where | Purpose | Lifetime | Party |
|---|---|---|---|---|
| __Host-codai-<app>-session-token | codai.ro/console, hub.codai.ro, pay.codai.ro | Keeps you signed in (encrypted session) | 30 days | First-party |
| __Host-codai-<app>-csrf-token, -callback-url, -state, -pkce-code-verifier, -nonce, -webauthn-challenge | codai.ro/console, hub.codai.ro, pay.codai.ro | Protect the sign-in flow against forgery and replay; remember where to return after sign-in | Session or 15 minutes | First-party |
| _session, _session.legacy, _interaction, _interaction_resume (+ .sig) | auth.codai.ro | Sign-in session at the Kodwen identity service and the state of a sign-in in progress | 14 days (session) / 1 hour (sign-in) | First-party |
| _codai_github, _codai_github_native, _codai_totp, _codai_consent | auth.codai.ro | Short-lived state while you sign in with GitHub, enter a two-factor code or confirm the terms for a new account created with Google, GitHub or an email link | Up to 10 minutes | First-party |
| NEXT_LOCALE | hub.codai.ro, pay.codai.ro | Remembers the language you picked — set only when you pick one; the sign-in page at auth.codai.ro reads it | Up to 1 year | First-party |
| codai-theme | codai.ro, hub.codai.ro, pay.codai.ro, docs.codai.ro | Remembers light/dark theme, accent and reduced motion — set only when you change them | 1 year | First-party |
| codai.sidebar.collapsed | codai.ro/console | Remembers whether the console sidebar is collapsed | 1 year | First-party |
| codai_preview | preview domain of cloud dev environments | Authorises your browser to open a port preview of your own dev environment | Short (minutes to hours) | First-party |
| Cloudflare Turnstile (challenge loaded from challenges.cloudflare.com) | auth.codai.ro (challenges.cloudflare.com) | Bot check on sign-up and after repeated failed sign-ins | Set by Cloudflare (short) | Third-party |
| __stripe_mid, __stripe_sid | pay.codai.ro (Stripe.js) | Fraud prevention during payment | 1 year / 30 minutes | Third-party |
02Browser storage (localStorage / sessionStorage)
- codai.ro console (after sign-in): a random device identifier (codai.console.deviceId) sent with console requests so you can recognise and revoke the browser, plus interface state: codai.sidebar.open-groups (sidebar groups), codai.notifications.lastSeen (last notification seen) and codai:getting-started-dismissed (dismissed onboarding card).
- All sites: codai-theme (your theme choice).
- Sign-up source: the campaign tags (utm_source, utm_medium, utm_campaign) and referring domain of the page you landed on are kept in the page’s memory only — never in browser storage — and travel in the sign-up link (a `src` parameter); see Privacy Policy, “Website analytics”.
- hub.codai.ro (after sign-in, only when you use the feature): codai.transcripts.live.translate and codai.transcripts.live.summary (whether the live translation and summary panels are shown), and codai-vault-sk:<account> — your vault Secret Key, only if you tick "remember on this browser". While the deletion of a vault item can still be undone, session storage holds codai.vault.pending-delete.v1:<account> (the identifiers of the items being deleted, a time and a flag, never their contents) until the deletion has been sent.
- hub.codai.ro service worker (registered only after you sign in): /serwist/sw.js keeps the dashboard’s static files in Cache Storage (hub-static, hub-assets and the build precache) so the app loads fast and shows an offline page, and uses a small IndexedDB index of cache entry ages to expire them. It contains no personal data and no page content.
- hub.codai.ro review links (/r/…): codai-reviewer-name — the display name you typed, so you do not retype it on your next comment; it stays in your browser and is sent only with the comments you post.
- Web app at app.codai.ro: your API key and app settings are kept in the browser’s local storage on your device only (never sent anywhere except to the Kodwen gateway with your requests); sign-in state (PKCE) is kept in session storage for the few seconds of a sign-in.
This storage never leaves your device except as described, is not used for tracking and is cleared when you sign out, clear site data or uninstall.
03Analytics and error tracking
codai.ro, docs.codai.ro and hub.codai.ro load Umami, an open-source analytics tool we host ourselves in the EU, to count page views and a few sign-up steps. It sets no cookies and stores nothing in your browser; it reads your screen size and browser language to report them in aggregate and checks a local "umami.disabled" opt-out flag. It ignores the query string and fragment of the page address and collects nothing when your browser sends Do Not Track. No third-party analytics and no profiling. Details: Privacy Policy, “Website analytics”. pay and the identity service load no analytics script.
Sentry error diagnostics on our sites set no cookies and are configured to collect no user details, cookies, headers or request bodies. Session replay is off.
04Referral links
Referral links (codai.ro/r/<username>) no longer set a cookie. The referral code travels only in the link to the sign-up page. A `codai_ref` cookie set before 11 October 2026 is no longer read for new visits and expires on its own within 30 days; you can delete it at any time.
05How to control cookies
You can block or delete cookies in your browser settings. Blocking the cookies above will stop sign-in, checkout or language/theme preferences from working, because they are strictly necessary.
Questions: privacy@codai.ro. More about how we process personal data: Privacy Policy (codai.ro/privacy).