Legal · Cookies
Cookie Policy
Which cookies and browser storage Interactive Media Solutions S.R.L. (IMS SRL) uses on codai.ro, hub.codai.ro, pay.codai.ro, docs.codai.ro and auth.codai.ro, and why none of them needs your consent.
Version 1.0 · Updated October 11, 2026
Summary in plain words
- We only use cookies and storage that are strictly necessary: to sign you in securely, to take payments safely, to stop bots and to remember the language and theme you chose.
- No advertising, tracking, profiling or analytics cookies. Our public-site analytics (Cloudflare Web Analytics) is cookieless and aggregate.
- Because everything here is strictly necessary (Law 506/2004 art. 4(5), ePrivacy Directive art. 5(3)), we do not show a cookie banner. If we ever add a cookie that needs consent, we will ask first.
01Cookies we set
Every cookie below is strictly necessary for a service you asked for. `<app>` is the name of the site (web, hub or pay). On plain-HTTP development builds the `__Host-` prefix is dropped.
| Name | Where | Purpose | Lifetime | Party |
|---|---|---|---|---|
| __Host-codai-<app>-session-token | codai.ro/console, hub.codai.ro, pay.codai.ro | Keeps you signed in (encrypted session) | 30 days | First-party |
| __Host-codai-<app>-csrf-token, -callback-url, -state, -pkce-code-verifier, -nonce, -webauthn-challenge | codai.ro/console, hub.codai.ro, pay.codai.ro | Protect the sign-in flow against forgery and replay; remember where to return after sign-in | Session or 15 minutes | First-party |
| _session, _session.legacy, _interaction, _interaction_resume (+ .sig) | auth.codai.ro | Sign-in session at the codai identity service and the state of a sign-in in progress | 14 days (session) / 1 hour (sign-in) | First-party |
| _codai_github, _codai_github_native, _codai_brivio, _codai_totp | auth.codai.ro | Short-lived state while you sign in with GitHub or Brivio or enter a two-factor code | Up to 10 minutes | First-party |
| NEXT_LOCALE | hub.codai.ro, pay.codai.ro, auth.codai.ro | Remembers the language you picked | Up to 1 year | First-party |
| codai-theme | codai.ro, hub.codai.ro, pay.codai.ro, docs.codai.ro | Remembers light/dark theme, accent and reduced motion — set only when you change them | 1 year | First-party |
| codai.sidebar.collapsed | codai.ro/console | Remembers whether the console sidebar is collapsed | 1 year | First-party |
| codai_preview | preview domain of cloud dev environments | Authorises your browser to open a port preview of your own dev environment | Short (minutes to hours) | First-party |
| Cloudflare Turnstile (cf_clearance and similar) | auth.codai.ro (challenges.cloudflare.com) | Bot check on sign-up and after repeated failed sign-ins | Set by Cloudflare (short) | Third-party |
| __stripe_mid, __stripe_sid | pay.codai.ro (Stripe.js) | Fraud prevention during payment | 1 year / 30 minutes | Third-party |
02Browser storage (localStorage / sessionStorage)
- codai.ro console: a random device identifier (codai.console.deviceId) sent with console requests so you can recognise and revoke the browser, plus interface state (sidebar groups, last notification seen, dismissed onboarding card).
- All sites: codai-theme (your theme choice).
- Web app at app.codai.ro: your API key and app settings are kept in the browser’s local storage on your device only (never sent anywhere except to the codai gateway with your requests); sign-in state (PKCE) is kept in session storage for the few seconds of a sign-in.
This storage never leaves your device except as described, is not used for tracking and is cleared when you sign out, clear site data or uninstall.
03Analytics and error tracking
The public website (codai.ro) loads Cloudflare Web Analytics, which sets no cookies, uses no local storage and does not fingerprint visitors; it counts page views in aggregate. The hub, pay, docs and identity sites do not load it.
Sentry error diagnostics on our sites set no cookies and are configured to collect no user details, cookies, headers or request bodies. Session replay is off.
04Referral links
Referral links (codai.ro/r/<username>) no longer set a cookie. The referral code travels only in the link to the sign-up page. A `codai_ref` cookie set before 11 October 2026 is no longer read for new visits and expires on its own within 30 days; you can delete it at any time.
05How to control cookies
You can block or delete cookies in your browser settings. Blocking the cookies above will stop sign-in, checkout or language/theme preferences from working, because they are strictly necessary.
Questions: [email protected]. More about how we process personal data: Privacy Policy (codai.ro/privacy).