# signafAIde cookie notice

Version: 1.0

Effective date: 13 November 2026

This notice explains what signafAIde, provided by AIME TECH UK LIMITED, stores in your browser. Our privacy notice has more detail on how we use personal data.

## Summary

- We use cookies only to keep you signed in to the console and to protect the sign-in process. They are strictly necessary and are set only when you sign in.
- We use no advertising, tracking or third-party analytics cookies.
- Our page-view analytics set no cookies, store nothing in your browser and store no IP address. If your browser sends Do Not Track or Global Privacy Control, no page view is sent at all.

## Cookies

| Name | Set when | Purpose | Lasts |
|---|---|---|---|
| `sfa_session` | You sign in to the console | Keeps you signed in. HttpOnly, SameSite=Lax, Secure on HTTPS | 30 days, or until you sign out |
| `sfa_oauth` | You start signing in with GitHub | Protects the GitHub sign-in against forgery | 10 minutes |
| `sfa_sso` | You start signing in through your organisation's SSO | Protects the SSO sign-in against forgery | 10 minutes |

These are strictly necessary for a service you have asked for, so we do not ask for consent to them.

Our staff admin site, which is not open to customers, sits behind Cloudflare Access, which sets its own sign-in cookie for staff.

## Other browser storage

| Name | Type | Purpose | Lasts |
|---|---|---|---|
| `sfa-theme` | Local storage | Remembers light or dark theme if you choose one | Until you clear it or choose "system" |
| `sfa-tab` | Local storage (website) | Remembers the code language you picked in the docs (for example Python or TypeScript) | Until you clear it |
| `sfa-last-project` | Local storage (console) | Opens the console on the last project you viewed | Until you clear it |

Each of these is set only when you use the feature it remembers. None is used for analytics.

## How our analytics work

When you open a page on our website, documentation or console, your browser sends our own server a short message with the page path, the referring site (only if you came from another site) and any campaign tags in the link. The message is sent without cookies, and nothing is read from or written to your browser's storage to send it.

On our server, we derive a browser family (for example "chrome") and a bot flag from your user agent, and a visitor hash from your IP address and user agent combined with a random value that changes every day and is never stored. We keep neither your IP address nor your full user agent. Visitor hashes cannot be linked from one day to the next, and they are the only way we count unique visitors. Raw page-view events are deleted after 90 days; we keep daily totals.

No data from our analytics is shared with third parties or used for advertising.

**Opting out.** If your browser sends a Do Not Track (`DNT: 1`) or Global Privacy Control (`Sec-GPC: 1`) signal, our pages do not send the page-view message at all. Most browsers let you turn one of these on in their privacy settings.

## Managing storage

You can delete cookies and local storage in your browser settings. If you delete `sfa_session`, you will be signed out.

## Contact

sales@signafaide.co.uk