Cookie Policy
Last updated: 2026-10-09
This page lists every cookie and every piece of browser storage OIO uses. It belongs with our Privacy Policy, which explains what happens to the data.
The short version
- Inside the app we only use what is needed to sign you in, keep you secure and remember your settings.
- On our public pages and the first-run setup page we would also like to use analytics and advertising cookies, to see which ads bring people who sign up.
- In the EEA, the UK and Switzerland we ask first, in a cookie banner. Until you accept, the Google Ads tag and the Meta Pixel do not load at all (no request goes to Google or Meta) and none of the analytics or advertising cookies below are set. Reject all is as easy as Accept all, and the site works the same either way. If we cannot tell which country you are in, we treat you as being in the EEA.
- Everywhere else they run by default, and you can turn them off the same way.
- You can change your answer at any time: .
Strictly necessary cookies
These are needed for the Service to work, so they do not need consent.
| Name | What it does | How long | Set by |
|---|---|---|---|
| sb-…-auth-token (may be split into .0, .1) | Keeps you signed in. Set by our sign-in system (Supabase) on our own domain. | Up to 400 days, renewed while you use the app; removed when you sign out | OIO (first party) |
| oio_mfa | Remembers that the account on this browser uses 2FA, so the sign-in page opens the code step. | 1 year | OIO |
| oio_onboarded | Remembers that you finished the welcome setup, so we skip a database check on every load. | 1 year | OIO |
| oio_ui | Only if you picked the old version of the app: remembers that choice. | 1 year | OIO |
| oio_status | Only on a password-protected client status page: keeps that page unlocked. | 1 hour | OIO |
| oio_consent | Your answer in the cookie banner (Analytics yes or no, Advertising yes or no, and when you answered), so we do not ask on every page. | 6 months, then we ask again | OIO |
| oio_cc | Your country code (two letters, from Cloudflare). Used only to decide whether we need to ask before the cookies below. | 30 days | OIO |
| Cloudflare security cookies (e.g. __cf_bm) | Only if our network flags traffic as possibly automated: tells people from bots. | 30 minutes | Cloudflare (on our domain) |
Browser storage for settings
The app also keeps a few things in your browser's local storage. They stay on your device; we do not read them from our servers.
| Name | What it does | How long | Set by |
|---|---|---|---|
| oio-theme, oio-locale | Your theme and language. | Until you clear it | OIO, local storage |
| oio.* and similar layout keys | Layout choices: collapsed panels, list sizes, view modes, zoom, whiteboard positions, dock state. | Until you clear it | OIO, local storage |
| Assistant history | Recent assistant messages, so the panel reopens where you left it. | Last 200 messages, until you clear it | OIO, local storage |
| Recording vault | A recording you just made, kept on your device until it has uploaded safely. | Until the upload finishes | OIO, IndexedDB |
| oio-funnel:* | Stops a page view on our public pages being counted twice in the same tab. Holds no id. | Until the tab closes | OIO, session storage |
| oio-utm-pending | Only in the EEA, UK and Switzerland, before you answer the banner: the campaign tags and ad click id from the link you came in on, so they can be saved as oio_utm if you accept Advertising. Stays in this tab, is never sent to us, and is deleted when you refuse. | Until the tab closes | OIO, session storage |
Analytics cookies (need your consent in the EEA, UK and Switzerland)
First-party only. The data stays in our own database and is used to count sign-up steps. Without them a step is still counted, just not linked to your other steps.
| Name | What it does | How long | Set by |
|---|---|---|---|
| oio_vid | A random id that links the sign-up steps of one visitor. Not tied to your name, email or IP. | 30 days | OIO |
| oio_fsrc | The site that sent you, when it was not an ad. | 30 days | OIO |
Advertising cookies (need your consent in the EEA, UK and Switzerland)
| Name | What it does | How long | Set by |
|---|---|---|---|
| oio_utm | The ad or campaign that first brought you (utm tags and the ad click id), so a sign-up can be credited to the right ad. | 30 days | OIO |
| oio_ref | The code of the affiliate whose link you clicked, so they get credit if you subscribe. | 60 days | OIO |
| _gcl_au, _gcl_aw | Google Ads (gtag.js): links an ad click to a sign-up. | 90 days | |
| Google cookies on google.com / doubleclick.net | Google Ads measurement, under Google's own policy. | Set by Google | |
| _fbp, _fbc | Meta Pixel: links an ad click to a sign-up. | 90 days | Meta |
| Meta cookies on facebook.com | Meta Pixel measurement, under Meta's own policy. | Set by Meta | Meta |
Google and Meta process this data under their own privacy policies: Google and Meta. We use Google Consent Mode (version 2): the Google tag is told your answer before it does anything, and in the EEA, UK and Switzerland it is only loaded after you accept Advertising. If you came from a Meta ad and sign up, we also tell Meta about the sign-up from our server, with your email hashed, so it can count it once. We do that only where the Advertising cookies are allowed for you.
Other things that load
- Cloudflare Turnstile (bot check on sign-up and public forms) runs in a frame from challenges.cloudflare.com. It reads browser signals to tell people from bots and does not set tracking cookies on our domain.
- KLIPY serves the GIFs you pick in chat. When a GIF is shown, your browser loads it from KLIPY's servers, which see your IP address. No cookies are set on our domain.
- Cloudflare may count page views on our site without cookies, for traffic statistics.
How to control them
Change or withdraw your answer at any time in . When you turn Advertising off we delete the Google and Meta cookies on our domain and our own click-id and affiliate cookies; turning Analytics off deletes oio_vid and oio_fsrc. You can also block or delete cookies in your browser settings at any time. If you block the necessary ones you will not be able to stay signed in. Blocking third-party cookies stops the Google and Meta ones. You can also ask us to delete your data, see the Privacy Policy.
Changes
When we add or change a cookie, we update this list and the date at the top. If the change needs a new answer from you, the banner asks again.