{"data":{"id":"cookies","title":"Cookie Policy","version":"0.9.0-draft","hash":"9bfb5027d86869fd14c121adbac42a7f6f76f7da16c787159c35ded5cda09716","status":"Draft — pending qualified counsel review","markdown":"---\ntitle: Cookie Policy\ndocument_id: cookies\nversion: 0.9.0-draft\neffective_date: \"[[LEGAL_REVIEW_REQUIRED: effective date set at launch]]\"\nstatus: \"Draft — pending qualified counsel review\"\noperator: Audon Software LLC\nproduct: Audon\n---\n\n# Audon — Cookie Policy\n\n> **Drafting note (remove before publication):** The inventory below must match the cookies and storage actually set by the application. Re-check it at every release that touches authentication, organization switching or the theme switcher. Not legal advice.\n\nThis Cookie Policy explains how **Audon Software LLC** (\"**we**\", \"**us**\"), the operator of Audon, uses cookies and similar technologies on the Audon website and web application. It should be read together with our Privacy Policy (document id `privacy`).\n\n## 1. What cookies and similar technologies are\n\nA cookie is a small text file that a website stores in your browser. Similar technologies include browser local storage, session storage, pixels and software development kit (SDK) device identifiers. In this Policy, \"cookies\" includes all of these.\n\nSome cookies are **strictly necessary**: the service cannot work without them, and laws such as the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive do not require consent for them. Other cookies are **optional** (for example, analytics or advertising cookies) and, where the law requires, may be set only with your prior consent.\n\n## 2. Our approach in summary\n\n- We use only a small number of first-party cookies.\n- **We do not use any analytics, advertising, social media, tracking or session-replay cookies, pixels or SDKs.**\n- We do not use third-party cookies on our website or application, other than on Stripe-hosted payment pages described in Section 5.\n- Because we have no optional analytics or advertising cookies, there is nothing to accept or refuse. We show a short informational notice on your first visit that lists the cookies we use (open it again any time via \"Cookie settings\" in the footer). It does not ask for consent, because we will not display a consent banner that implies choices that do not exist. If we ever add an optional category, it will be off by default and load only after you opt in.\n\n## 3. Cookies we set\n\n| Name | Category | Purpose | Duration | Set when | Attributes |\n|---|---|---|---|---|---|\n| `aa_session` | Strictly necessary | Keeps you signed in. Contains a random session token; only a hash of the token is stored on our servers. | 14 days | You sign in | First-party, HttpOnly, Secure, SameSite=Lax |\n| `aa_org` | Strictly necessary | Remembers which of your organizations is currently active, so requests are scoped to the correct tenant. Contains an organization identifier only. | Browser session (deleted when you close the browser) | You switch organization | First-party, HttpOnly, Secure, SameSite=Lax |\n| `aa_theme` | Preference (functional) | Remembers whether you chose the light or dark display theme. | 12 months | Only when you actively choose a theme | First-party |\n\n`aa_theme` is set only as a direct result of your request to change the theme, to provide the setting you asked for. We treat it as falling within the \"strictly necessary\" exemption for a service explicitly requested by the user. If you do not choose a theme, it is never set, and the interface follows your device setting. [[LEGAL_REVIEW_REQUIRED: confirm aa_theme qualifies for the PECR/ePrivacy strictly-necessary exemption]]\n\nNone of these cookies is used to track you across other websites, to build a profile of you, or for advertising.\n\n## 4. Other device storage\n\nWe do not store provider credentials, session tokens or personal data in browser local storage or session storage. We write two local storage entries, both in your browser only and never sent to us: `aa_consent` records the choices you made in the cookie dialog (whether Preferences is allowed, a policy version and a timestamp; no identifier), and `aa_estimate` keeps the rough range from the savings calculator when you click \"Get my exact number\", so the app can show it next to your audit results (removed when you dismiss it). Provider admin API keys are never sent back to your browser after you submit them.\n\n## 5. Third-party pages\n\nWhen you pay for a subscription or open the billing portal, you are taken to pages hosted by **Stripe**. Stripe may set its own cookies on those pages for purposes such as fraud prevention and keeping the payment session working. These cookies are controlled by Stripe and are described in Stripe's own cookie and privacy notices. We do not receive information from those cookies.\n\n## 6. Your choices\n\n**6.1 Strictly necessary cookies.** You can block or delete cookies using your browser settings. If you block `aa_session` or `aa_org`, you will not be able to sign in or use the application.\n\n**6.2 Preferences.** You can remove the `aa_theme` cookie by clearing cookies for our site or by choosing to follow your device's theme setting in the interface.\n\n**6.3 No optional cookies to manage.** Because we set no optional cookies, there is no cookie-preference control and no consent record for cookies. The inventory in Section 3 is the complete list. If we introduce optional cookies, we will add preference controls first, as described in Section 7.\n\n**6.4 Rejecting optional cookies never blocks core features.** If we introduce optional cookies in future, rejecting them will not prevent you from using any essential feature of the Services.\n\n## 7. If we introduce optional cookies in future\n\nWe do not plan to use analytics or advertising cookies. If that changes, before any optional cookie or similar technology is used we will:\n\n1. update this Policy and the inventory in Section 3, naming each cookie, its provider, purpose and duration;\n2. where consent is required by law, show a consent interface with equally prominent **Accept**, **Reject** and **Manage** options, with no pre-selected optional categories;\n3. not set any optional cookie, or load any optional script, until you have given consent where it is required;\n4. record your choice in a consent cookie and in our consent records, with the version of this Policy you saw, and add that cookie to the inventory in Section 3;\n5. let you withdraw consent as easily as you gave it, and stop the affected use when you do; and\n6. apply your choice consistently across our website and application, and provide a cookie-preference control in the website footer and account settings, with the same function available through the API.\n\n## 8. Changes and contact\n\nWe will update this Policy when the cookies we use change. Each version has a version number and effective date, and previous versions are archived in our legal documents index.\n\nQuestions: [[LEGAL_REVIEW_REQUIRED: privacy contact email]].\n"},"meta":{"request_id":"req_01m61e3pr1nv5r6p3bst2b","operation":"legal.get"}}