Cookies
We use the smallest set of first-party cookies we can. No analytics cookies of any kind, no third-party analytics, no cross-site tracking, no advertising pixels. We do count our own funnel steps in aggregate, on our own servers, and that is described plainly below.
What we use
| Name | Purpose | Duration | Type |
|---|---|---|---|
| sb-access-token / sb-refresh-token | Sign-in session. Without these you can't stay signed in. | Session + 1 week | Essential |
| jcil_assent | Carries your age and Terms confirmation across the round trip to Google when you sign up with it, so the confirmation you ticked is recorded with the account. Written only on that one click. | 10 minutes | Essential |
| Bot-check cookies (two, set by our bot-protection provider) | The bot check on the sign-in and sign-up forms. It also writes short-lived values to browser storage while the challenge runs. Set only on those two pages, never during a conversation. | Session to 30 minutes | Essential |
Not in production: our hosting provider sets one session cookie on internal preview deployments so we can view unreleased builds. It is never set on jcil.ai.
What we don't use
- Analytics cookies of any kind. No Google Analytics, no third-party analytics of any kind, no tracking scripts.
- Facebook Pixel or any ad-network tracker.
- Cross-domain tracking cookies.
What we count ourselves
We do count our own funnel, on our own servers, without a cookie. Four steps, in aggregate: a marketing page was viewed, an account was created, a first message was sent, a purchase was made. The signed-in steps are tied to your account so we can tell one person from two. None of it is ever tied to what you say in a conversation, and a private chat records nothing at all.
If the link that brought you here carried campaign tags (the utm_source and utm_campaign kind), we keep those tags, the page you landed on, and the site that sent you in your browser's session storage for that tab only. Session storage is not a cookie: it is never sent with requests, it is not shared across tabs, and it is gone when the tab closes. If you then create an account, those tags are saved with it once, so we can see which campaigns bring people who stay. We never store your IP address with any of this, and none of it goes to a third party.
One thing worth naming plainly, because it is close enough to analytics to deserve it: when a page throws an error, our error-monitoring provider records a short session replay of that error so we can see what broke. Text and form inputs are masked, it runs on errors only, and that provider is listed on the subprocessors page under Error monitoring.
What we keep in your browser, not in a cookie
A few preferences live in your browser's local storage rather than a cookie, which means they stay on that device and are never sent to us with a request: your light or dark theme choice, whether you have seen the welcome tour, whether you have dismissed the backup-model banner, the model preference kept for older conversations, and the flag that turns the landing page animation off. Clearing site data in your browser removes all of them.
Managing cookies
Every modern browser lets you delete cookies for a specific site. Clearing JCIL.AI cookies will sign you out. The essential authentication cookies will be recreated the next time you sign in, we don't offer a way to use the app without them.
"Do Not Track"
We don't sell, share, or monetize cookie data, so a DNT signal doesn't change our behavior, there's nothing to turn off. California residents who want a formal opt-out can use the privacy policy's CCPA rights section.