Cookies Policy
What ARIA OS stores in your browser, measured rather than assumed.
Effective 3 September 2026 · Last updated 3 September 2026
1. The short version
These marketing pages set no cookies. Not analytics, not advertising, not preference. We loaded this site in a clean browser, moved between every page, and read back what the browser had stored: nothing in cookies, nothing in local storage, nothing in session storage.
The signed-in ARIA OS application, on this same domain, does set cookies: it cannot keep you logged in otherwise. Those are listed in section 3.
2. Why we measure instead of listing
A cookie policy is easy to get wrong in both directions, and both are failures. Naming a cookie the site does not set makes the document untrustworthy the first time somebody checks. Omitting one it does set is worse. We have made the first mistake before on a sister site: the policy named an analytics cookie that was never actually being written, which is why the list below comes from a browser rather than from a template.
3. Cookies the signed-in application sets
You only encounter these after you sign in at /auth/login. None of them is set by browsing the marketing pages.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
sb-<project>-auth-token…-auth-token.0, .1 | Essential: authentication | Holds your Supabase session so you stay signed in between requests. Split across numbered cookies when the token is larger than one cookie can hold. Without it there is no way to be logged in. | Until sign-out or session expiry |
activeBrandId | Essential: application state | Remembers which brand you are currently working on, so switching brands survives a page load. It holds an identifier, nothing about you. | Until sign-out or you clear it |
__site_preview | Essential: functional | Written only when you deliberately open a site preview, and only for as long as that preview lasts. It carries a short-lived token that lets you view unpublished content. | The preview session |
ph_phc_<token>_posthog | Analytics: PostHog | Product analytics inside the application: which screens are used, where errors happen. It distinguishes one browser from another so a sequence of actions can be read as one session. A local-storage entry of the same name holds the same data. This is set inside the application only, never on these marketing pages. | Up to 12 months |
4. What we deliberately do not use
- No Google Analytics on this site.ARIA OS’s marketing pages load no GA4 tag and set no
_gacookie. Our company site at ceranovaai.com does use GA4 and discloses it in its own cookies policy; this is a different site. - No advertising or remarketing cookies, and no third-party trackers.
- No cross-site tracking, and nothing that follows you to another website.
- No cookie banner, because on these pages there is nothing to consent to. A banner asking permission for cookies we do not set would be theatre.
5. Third-party requests these pages do make
A request is not a cookie, but it is still information leaving your browser, so we disclose it rather than describing only the parts that store something.
- Google Fonts (
fonts.googleapis.com): one stylesheet, for the icon set used in the interface. Google receives that request, which includes your IP address as any web request does. No cookie is set on this domain by it. The typefaces the site is set in are served from this domain, not from Google.
What this section used to say, and why it does not any more. It named a second Google font host, and described Vercel Web Analytics and Vercel Speed Insights as measuring page views and page-speed here. Measured on this deployed site in a clean browser on 5 September 2026 (nine pages by direct load and eight more by clicking between them), neither is true: the font files come from this domain, and no analytics script is requested at all. The claim was inherited from a local build, where those two components do not mount, so it had never been checked against the running site. This page holds itself to not naming what the site does not do, in either direction.
6. Controlling what is stored
Every browser lets you view, block and delete cookies and site data. Blocking cookies for this domain has no effect on the marketing pages, because they set none. It will prevent you from signing in to the application, since the session cookie is what keeps you signed in.
The PostHog analytics cookie can be blocked without affecting your ability to use ARIA OS. You can also enable your browser’s “Do Not Track” setting or use a private window, and you can ask us to delete the analytics associated with your account at any time . See the privacy policy.
7. Changes
If we add anything that stores data in your browser, this page changes in the same release that adds it, not afterwards. A policy that lags the code is a policy that is wrong for as long as the lag lasts.