01What cookies are
Cookies are small text files a website places on your device. Browsers also offer local storage, session storage and IndexedDB, which privacy law treats like cookies, so this policy covers them the same way. AirLLM's own pages mostly use browser storage rather than cookies — to keep you signed in, protect your account, carry sign-in steps between pages, and remember choices you make. We use analytics cookies only if you accept them, and we don't use advertising cookies. This policy applies to AirLLM's websites and web applications; API traffic from your tools does not use cookies.
02Cookies & storage we use
This is everything our own pages keep in your browser. The names are the exact ones you'll see in your browser's developer tools. Local storage stays until it's removed; session storage goes when you close the tab. Analytics cookies, set only if you accept them, are in Section 03.
Strictly necessary
Needed to sign you in, protect your account, and finish sign-in and invitation steps. Because they're strictly necessary for a service you ask for, they don't need consent; blocking them stops sign-in from working.
| Item | Kept in | Purpose | How long |
|---|---|---|---|
Dashboard sign-insessionTokenemailIduserIdtenantIddepartmentId | Local storage | Keeps you signed in to the dashboard: your session token, your email address, and the numbers that identify you, your organization and your department. When cookie sign-in is turned on, a secure, HttpOnly session cookie set by api.airllm.ai holds the token instead of sessionToken. | Until you sign out. An open dashboard signs you out after 15 minutes without activity. |
Your profile and rolefullNamecompanyNametenantNameroleNameroleIduserRolesuserPermissionIds | Local storage | Shows your name, organization and role on every dashboard page, and decides which menus and actions you can use, without asking our servers again on each page | Until you sign out |
How you signed inuserStatusauthProviderhasPasswordssoLogintenantSsoEnabled | Local storage | Remembers how you signed in (password, Google or single sign-on), whether your account has a password, whether your organization uses single sign-on, and whether your account is still waiting for approval, so the right pages and settings show | Until you sign out |
Security tokenairllm.csrf | Session storage | Protects your account against cross-site request forgery | Until you sign out or close the tab |
Encryption keypref_publicKey | Local storage | Keeps our server’s public encryption key, so what the sign-in and dashboard pages send can be encrypted without fetching the key every time. It’s the same for everyone and says nothing about you. | Until we change the key or you clear site data |
Sign-in stepsairllm.ssoEmailairllm.ssoDestairllm.sso.csairllm.inviteHandoffairllm.termsAccepted | Session storage | Carries single sign-on and invitation steps from one page to the next (the email you entered, where to go afterwards, a one-time check that ties single sign-on to this tab, and the invitation you’re accepting), and remembers that you agreed to the Terms while you finish signing up | Until you close the tab. Most are removed as soon as the step is done. |
Google sign-outairllm.fbPendingSignout | Local storage | Tells the sign-in page to end your Google sign-in session after you sign out of the dashboard | Until the sign-in page next opens |
Plan noticeairllmPlanSeenairllm.noPlan | Local storage · session storage | Stops the dashboard’s “no active plan yet” notice once your account has a plan. airllmPlanSeen holds your account number and email address. | airllmPlanSeen: until you clear site data (it stays after you sign out) · airllm.noPlan: until you close the tab |
Analytics choiceairllm-analytics-consent | Local storage | Remembers whether you accepted or declined analytics, and on which day, so we don’t ask on every page | Until you clear it. We ask again when our analytics terms change. |
Google sign-in codefirebaseLocalStorageDb__sak | IndexedDB · local and session storage | Google’s Firebase sign-in code runs on our sign-in page. When the page opens, it creates this database and writes a test entry (__sak) to check that your browser’s storage works. With our settings it keeps no sign-in data: the database stays empty, and the test entry is removed at once. | The empty database stays until you clear site data; the test entry is removed straight away |
Staff toolsairllm.cookieSession | Local storage | Used only by our own staff: a switch for testing cookie sign-in. It isn’t set when you use the site. | Until removed |
Preferences
These remember choices you make. They're set only when you use the feature, and none of them tracks you.
| Item | Kept in | Purpose | How long |
|---|---|---|---|
Site themeairllm-theme | Local storage | The look you picked for our public website | Until you change it or clear site data |
Dashboard themeairllm.theme | Local storage | Light or dark mode in the dashboard | Until you change it or clear site data |
Animationsairllm-motion | Local storage | Remembers that you paused the site’s animations | Until you turn them back on |
Developer Guideairllm-dd-os | Local storage | The operating system you picked (macOS, Windows or Linux), so its setup steps show first | Until you change it or clear site data |
AirCode sessionsairllm.aircode.allUsers | Local storage | In the dashboard, whether an admin sees everyone’s AirCode sessions or only their own | Until you change it or clear site data |
Getting startedairllm.journey | Local storage | In the dashboard, your progress on the getting-started checklist: whether you’ve seen the welcome and the tour, the steps you marked done, whether you hid the checklist, and whether your account already sends requests (so the guide stays out of the way once you’re set up). It holds your account number and email address with that progress. | Until you clear site data (it stays after you sign out) |
We don't use advertising or cross-site tracking cookies.
03Analytics — only if you accept
When you first visit, a banner asks whether we may use analytics. If you click Accept, we use Google Analytics, through our Google Firebase project, to understand how our website is used: which pages people visit, how they arrive, and which links and steps they use. It helps us decide what to improve. If you click Decline or don't choose, Google Analytics isn't loaded and none of this is collected.
If your browser sends a Global Privacy Control signal, we treat it as a no, always: we don't show the banner, we
never load Google Analytics — even if you accepted before — and we delete any _ga cookies. Cookie settings then
shows a short note instead of the choice.
| Item | Category | Purpose | How long |
|---|---|---|---|
Google Analytics_ga | Analytics only if you accept | Tells one browser from another with a random ID, so visits can be counted | 2 years, unless you clear it or decline |
Google Analytics_ga_9EQF4BY1K8 | Analytics only if you accept | Keeps track of the current visit | 2 years, unless you clear it or decline |
- Page views — one each time a page loads: its address with the query part removed (we keep only campaign tags
such as
utm_source, which tell us which link or campaign brought you), its title, and the page you came from, also without its query part. - Actions our own code reports — finishing sign-in or sign-up (only the method: email, Google or single sign-on); clicking a sign-in, contact or documentation link (the link's address and text, and whether it was in the header, the footer or the page); downloading a setup script (the file's name); copying a code sample; following a link from one of our articles to a product page; and sending the contact form (only that it was sent).
- What Google Analytics adds by itself — your first visit and the start of each visit, how long a page stays open in front of you, your approximate location (country and city, which Google works out from your IP address; Google Analytics doesn't store IP addresses), and your device type, browser, operating system, screen size and language.
- What isn't collected — your name, email address, anything you type into forms, prompts, code, or API keys. Google signals, ad personalization and user-provided data collection are turned off, and so is Google Analytics' own tracking of site searches, form use, videos and address changes within a page. The data isn't used for advertising, and we don't sell it.
- Who processes it — Google LLC processes this data for us as a service provider under its data processing terms, and may process it outside your country, including in the United States. Google Analytics keeps event-level data for up to 14 months; our reports show totals, not individual people.
- Changing your mind — use Cookie settings, in the
footer of every page of our public website, to accept or decline at any time. If you decline after accepting, we stop
collecting and delete the
_gacookies from your browser.
04Third parties
Fonts, icons and script libraries are served from our own site, so opening a page doesn't contact a font or file host. The outside services your browser does contact are Cloudflare, which delivers every page (and runs Turnstile on the contact and sign-in forms); Google Firebase, for sign-in on our sign-in page and Google's own window when you choose Continue with Google; Stripe, only when you open a checkout or billing page; and Google Analytics, only after you accept.
These services set and control their own cookies, under their own cookie and privacy policies. AirLLM does not control those cookies and, to the maximum extent permitted by applicable law, is not responsible for them; please review the relevant third party's policies.
| Service | Category | Purpose | How long |
|---|---|---|---|
| Cloudflare | Necessary for security | Delivers our website and protects it from attacks. Like any web host, it sees your IP address and browser details. It may set a short-lived security cookie, such as __cf_bm, to tell people from bots. | Set by Cloudflare (__cf_bm: 30 minutes) |
| Cloudflare Turnstile | Necessary for security | Bot protection on sign-in, sign-up and the contact form, and when you reset your password. It runs in Cloudflare’s own frame and keeps its own item there (cf.turnstile.u); it sets nothing on airllm.ai. | Set by Cloudflare |
| Google sign-in via Google Firebase Authentication | Necessary when you choose Continue with Google | On our sign-in page, Firebase’s code talks to Google’s sign-in service. Continue with Google opens Google’s own window, which uses Google’s cookies under Google’s policies. | Set by Google |
| Your organization’s single sign-on | Necessary if your organization uses it | You sign in on your organization’s own sign-in page, which sets its own cookies | Set by that provider |
| Stripe | Necessary for payments | Payment and fraud prevention on Stripe’s own checkout and billing pages (not on airllm.ai) | Set by Stripe |
| Google Analytics | Analytics only if you accept | Counts visits and the actions listed in Section 03 | 2 years (see Section 03) |
05Managing cookies & storage
- Analytics asks first. Our banner asks before any analytics cookie is set. Strictly necessary storage and preferences you set don't need consent. Change your choice anytime with Cookie settings, in the footer of every page of our public website. Analytics isn't used in the dashboard, so it has no Cookie settings link.
- Clear site data. You can clear cookies and site data for airllm.ai in your browser at any time. Clearing it signs you out and resets your preferences; blocking it entirely stops sign-in from working.
- Third-party cookies. Manage cookies set by the services in Section 04 through your browser or those services' own settings.
- Global Privacy Control. We honor GPC browser signals: with GPC on, we don't show the banner and never load analytics, even if you accepted before. See also our Privacy Policy.
06Changes & contact
We update this policy when our use of cookies or browser storage changes, and revise the "Last updated" date above. Material changes are announced with the same notice commitments as the Privacy Policy. Questions? Write to our Legal Cell at legal@airllm.ai or reach us through our Contact page.
What changed in version 1.1: the storage tables now list every item our site keeps in your browser, with its purpose and how long it lasts; fonts, icons and script libraries come from our own site; Section 03 says exactly what Google Analytics collects; and a Global Privacy Control signal turns analytics off even after an earlier Accept.