1. What these technologies are
Cookies are small text records a website stores through a browser. Local storage keeps a named value in the browser until it is removed or expires logically. Session storage keeps a named value for the browser tab's session. We refer to them together as "technologies".
2. Current Qiko technologies
The following technologies are necessary for requested authentication, security, consent choices and password reset continuity. They do not require optional consent because the relevant service cannot operate securely or remember the requested choice without them.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| qiko_access | Cookie | Authenticates the current signed-in request. | 15 minutes |
| qiko_refresh | Cookie | Maintains and renews an authenticated session. | 14 days |
| qiko_csrf | Cookie | Supports double-submit protection against cross-site request forgery. | 14 days |
| qiko.password-reset.email | Session storage | Carries the email entered in the requested password-reset flow between pages. | Current browser tab session, and removed after use where the flow completes |
| qiko.consent.v1 | Local storage | Records consent schema and policy versions, necessary/preferences/analytics/marketing choices, choice source, timestamps, logical expiry and detected GPC/DNT signals. | 12-month logical expiry, then Qiko asks again |
| qiko.consent.anonymous-id | Local storage | Provides a random browser identifier that the server stores only as a keyed pseudonym for anonymous consent history. | Until browser storage is cleared |
| qiko.consent.pending-sync | Local storage | Temporarily retains a validated consent decision when server synchronization fails, so it can be retried. | Until synchronized, expired or superseded |
The authentication cookies are always necessary. Depending on browser and server controls, some cookie attributes prevent JavaScript access and limit when the browser sends them.
3. Conditional security and payment providers
Cloudflare may set security cookies when its protection is active, including cookies such as __cf_bm for bot management or cf_clearance after a security challenge. These are necessary for network security and availability. Their presence and duration depend on the Cloudflare protection presented to the browser and may change with security configuration.
If payment checkout is enabled and a user chooses to start it, Qiko redirects the user to a Stripe-hosted page. Stripe may then use cookies or similar technologies on its domain for checkout, fraud prevention, security and payment processing under Stripe's own notices. Qiko does not load Stripe checkout merely because a user visits Qiko.
4. Optional categories
- Necessary: always on for core functionality, security and remembered consent. This category cannot be switched off in Qiko.
- Preferences: remembers optional interface settings across visits when enabled.
- Analytics: would measure how visitors and users interact with Qiko to improve the Service. Qiko does not currently load browser analytics technologies.
- Marketing: would support advertising or marketing measurement. Qiko does not currently load browser marketing technologies.
Preferences, analytics and marketing default to off. No script in either category loads before consent, and no analytics or marketing script loads today even if consent is given. A saved choice prepares Qiko to gate a future technology, but Qiko must update this policy before describing any new technology as active.
5. Consent choices and expiry
The first time consent is needed, Qiko offers equally available choices to accept all, reject non-essential technologies or manage preferences. The consent record uses schema version 1 and policy version 2026-07-24. It records necessary as true, analytics and marketing choices, the choice source, decided, updated and expiry timestamps, and detected privacy signals.
A choice expires logically after 12 months. An invalid, expired or different-policy record is treated as no consent: optional categories remain denied and Qiko asks again. If browser storage is unavailable, optional categories remain denied and the banner may reappear.
6. Global Privacy Control and Do Not Track
When Qiko detects Global Privacy Control (GPC), marketing is locked off even if "Accept all" is selected. When Qiko detects Do Not Track (DNT), analytics and marketing default to off, but the user may change those choices. Browsers expose these signals inconsistently, so Qiko can respond only when a signal is made available to the page.
7. Change or withdraw consent
Open at any time to change your choice. Withdrawal stops future use through Qiko's consent gates. Qiko removes only non-essential cookies or storage names registered to the withdrawn category. It never removes authentication, CSRF, password-reset or consent storage as optional cleanup.
You can also delete or block technologies in browser settings. Blocking necessary cookies can prevent sign-in and secure features from working. Deleting qiko.consent.v1causes Qiko to default optional categories to denied and ask again.
8. Changes and contact
We may update this policy when technologies, providers or legal requirements change. We will revise the effective date and seek consent again where required. Questions can be sent tosupport@qiko.ai.