Cookie Policy

Cookies are small text files that a website stores in your browser. Similar technologies, such as browser storage, work in much the same way. They let a site remember who you are between pages and keep it secure.

Every cookie below is set by us (first-party), is strictly necessary for the Service to work, and is marked HttpOnly (scripts on the page cannot read it) and SameSite=Strict (it is never sent with requests from other sites). In production they are also marked Secure.

• accessToken

  What it does

  Keeps you signed in. A signed token that proves who you are on each request.

  How long it lasts

  Up to 15 minutes

• refreshToken

  What it does

  Renews your sign-in without asking for your password again.

  How long it lasts

  Up to 7 days, or until you sign out

• __Host-x-csrf-token

  What it does

  Protects you against forged requests from other sites. In non-production environments it is named x-csrf-token.

  How long it lasts

  Session (removed when you close the browser)

Because these cookies are essential, we do not ask for your consent to set them. If you block them, you will not be able to sign in.

Our error monitoring and logging tools may use browser storage, such as session storage, to keep technical diagnostics together during your visit. They do not set advertising cookies. See the Privacy Policy for what these tools collect.

You can view, block or delete cookies in your browser settings, and signing out removes the sign-in cookies. Doing so does not affect the rest of the site, but blocking essential cookies will stop sign-in from working.

If we add cookies or tools that are not strictly necessary, such as analytics or marketing, we will update this page and ask for your consent first where the law requires it, before those cookies are set.

Questions about this policy? Write to privacy@upstarai.com.