Legal
Cookie & Local Storage Policy
Effective Date: November 15, 2025 · Last Updated: November 15, 2025
This policy explains how EVA AI, Inc. ("EVA," "we," or "our") uses cookies, local storage, and similar technologies when you visit evaonline.ai or use the EVA dashboard. It works in tandem with our Privacy Policy and Terms of Service.
1. What Are Cookies and Similar Technologies?
Cookies are small text files stored on your device by your browser. We also rely on local storage, session storage, and other identifiers (e.g., Cloudflare Turnstile tokens) to keep your session secure and personalize your experience. Some of these technologies are set by EVA, while others originate from service providers that help us deliver the platform.
2. Why We Use Them
- Authentication: Keep you signed in and route API calls to your account.
- Security: Detect suspicious activity, enforce rate limits, and verify Cloudflare Turnstile captchas on support forms.
- Preferences: Remember the last model you selected, sidebar state, or filters applied across sessions.
- Product Analytics: Measure aggregated usage of features to prioritize roadmap decisions. We use PostHog — no advertising trackers or cross-site tracking pixels are set.
- Performance: Balance traffic across regions, diagnose errors, and maintain availability when upstream LLM providers fluctuate.
3. Types of Cookies/Storage We Rely On
Essential (Strictly Necessary)
Required for the site to function. Includes authentication tokens (stored securely in HTTP-only cookies or secure storage), session IDs, CSRF tokens, and load balancer cookies. Disabling these will break login, chat, and billing flows.
Preference & Productivity
Remember UI choices (sidebar collapsed state), preferred AI model, and locale. These are typically stored in local storage so they persist between sessions.
Analytics & Performance
Collect usage metrics (page views, feature interactions, error frequency) via PostHog. We use these signals to improve stability and spot regressions. No advertising IDs or cross-site tracking pixels are set. These cookies are only set after you give explicit consent via the banner shown on your first visit.
Third-Party Security
Cloudflare Turnstile sets temporary identifiers to confirm that a real human is submitting support or feature request forms. Google Cloud Storage may set cookies when you upload or download files. These expire automatically after the session or a short retention period.
4. Third Parties with Access
The following service providers may place or read cookies when you interact with EVA:
- PostHog: Product analytics platform. Used to track feature interactions and page views after consent. No data is shared with advertisers.
- Sentry: Error and performance monitoring. Captures unhandled exceptions. Chat message contents are always redacted before transmission. No cookies are set — data is sent via a server-side tunnel.
- Cloudflare: Turnstile captcha tokens and edge security cookies.
- Google Cloud: Session cookies related to Cloud Storage uploads/downloads.
- Stripe: Cookies required to complete checkout securely.
Each vendor is bound by data-processing agreements that limit how they can use the data collected on our behalf.
5. Managing Preferences
Most browsers let you control cookies via settings usually found under "Privacy" or "Site Settings." You can delete cookies, block third-party cookies, or clear local storage at any time. Please note:
- Blocking essential cookies will prevent login and use of the EVA dashboard.
- Preference data (like model selection) will reset if you clear local storage or use private browsing.
- You can manage non-essential analytics cookies through the banner that appears on your first visit, by clearing your browser's local storage for evaonline.ai to re-trigger it.
6. Retention & Expiration
| Category | Typical Lifespan | Purpose |
|---|---|---|
| Session/Authentication | Expires when you log out or after 24h idle | Maintain secure access to your workspace |
| Preference Storage | Until cleared or 12 months | Remember UI choices and last-used model |
| Analytics/Performance | 30–90 days | Trend analysis and product debugging |
| Turnstile & Security Tokens | Minutes to 1 day | Prevent automated abuse of forms |
7. Updates to This Policy
We may revise this Cookie Policy to reflect new vendors, features, or regulatory guidance. The "Last Updated" date above indicates the most recent version. Significant changes will be highlighted in the cookie banner or via in-app notices.