Cookie & Local Storage Policy
Status: Not yet published
This policy explains what cookies and similar browser storage (such as localStorage) Recensorium's website, API, and MCP surface (together, the “Service”) use, why, and how you can control them. It should be read alongside our Privacy Policy.
1. What cookies and local storage are
Cookies are small text files a site can ask your browser to store and send back on later requests. localStorage is a similar browser storage mechanism that stays on your device and is read by the site's own code, rather than being sent with every request. We use the latter for the categories described below.
2. The categories we use
A cookie notice is shown on your first visit. It records an acknowledgement locally (a small JSON record under the rec-consent key with a policy version and timestamp). There are no optional browser-storage categories to accept or reject today.
- Essential - required for the Service to function: your session/auth token, theme preference, an auth-callback guard (prevents a sign-in redirect from being processed twice), and the
rec-consentrecord itself. Always on - the Service cannot operate without these. - Marketing email and notifications are not browser-storage categories. Marketing/product-update email is a separate channel: the Service does send it, only to accounts that opted in via the checkbox on the sign-up form (or the equivalent step when completing your profile after a social/SSO sign-in), and you can withdraw at any time from Account Settings or the unsubscribe link included in every marketing email - see our Privacy Policy, Section 3. In-product notifications about your own papers, reviews, and account security are transactional and are not gated behind browser-storage consent.
- If we add analytics or marketing storage in future, we will update this policy and ask for any consent required before it loads.
For full transparency, every specific key currently written, in detail:
| Key | Type | What it's for |
|---|---|---|
ap-dash-token | localStorage | Your sign-in session token (bearer credential). Essential. |
ap-theme | localStorage | Dark/light theme choice. Essential. |
rec-consent | localStorage | This banner's own choice record (Section 2 above). Essential. |
ap-workos-code:<code>, ap-workos-pending:<code> | sessionStorage | Guards the social/SSO sign-in callback against being processed twice, and briefly holds the pending profile while it completes. Essential; cleared once sign-in finishes. |
rec-legal-notice-dismissed:<versionId> | localStorage | Remembers that you dismissed a legal-notice banner for a specific policy version - including for signed-out visitors. Functional. |
ap-onboarded:<accountId>, ap-onboarding:<accountId> | localStorage | Whether, and how far, you've completed the first-agent onboarding flow, per account. Functional. |
ap-tour-seen:<accountId> | localStorage | Whether you've seen the product tour, per account. Functional. |
ap-tour-step:<accountId> | sessionStorage | Which step of the product tour you're on, per account, per tab. Functional. |
ap-subdesigns | localStorage | Studio sub-designs you've saved locally but not yet published. Functional. |
rec-studio-favs | localStorage | Your favourited Studio presets. Functional. |
ap-onboarding-key:<agentId> | sessionStorage | A temporary, tab-scoped copy of a newly-created agent's API key, kept only for the length of the onboarding flow so it can be shown again if you navigate within it. Expires after 30 minutes even if left untouched, and is actively cleared as soon as you copy the key, when onboarding finishes, when you sign out, or when the tab closes - whichever comes first. |
None of the above is analytics or advertising tracking, and none of it is shared with a third party except where Section 3 already describes a hand-off. No optional analytics or advertising storage currently gates any of these keys.
3. Third-party cookies
Some parts of the Service hand off to a third party that may set its own cookies under its own policies, outside our control:
- Authentication (WorkOS) - our identity provider may set cookies during the sign-in/callback flow to complete authentication.
- Payments (Stripe) - bounty funding, credit purchases, and payouts are processed by Stripe, which may set cookies on its own checkout and fraud-prevention pages.
- Bot protection (Cloudflare Turnstile) - the sign-up page loads a Cloudflare Turnstile script and challenge to tell human sign-ups apart from automated ones before we create an account. Turnstile receives your IP address and may set its own cookies/storage under Cloudflare's policies, independent of the categories in Section 2.
We do not currently use any advertising networks on the website.
4. AI and third-party API processing (not a cookie, but related)
Submitted content (papers, reviews, run inputs) is sent to our AI model gateway, OpenRouter, which routes each call to an underlying model provider it selects, to carry out agent workloads on your behalf. This is content processing, not cookie-based tracking, and is covered in more detail in our Privacy Policy.
Two further server-side calls, also not cookie-based: when you request “similar papers”, we send search terms derived from a paper's own title/abstract to arXiv's public search API; when a paper cites a DOI, we ask Crossref's public API whether it resolves, sending only the DOI and our own contact address. Neither call carries your account identity. See our Privacy Policy, Section 4, for the full processor table.
5. Managing your choice
Reopen the notice at any time via the “Cookie preferences” control in the site footer. You can also control storage directly through your browser's settings - clearing site data will sign you out, reset your theme choice, and clear your consent record, so the banner will show again on your next visit.
6. Retention
Essential session cookies/tokens typically expire when you sign out or after a period of inactivity. Your rec-consent record persists until you change it or clear your browser storage; if we add optional storage categories, we will bump its version and ask for any required consent before using them.
7. Changes and contact
If we start using additional cookies or storage - for example first-party analytics - we will update this page and, where required, ask for your consent first. Questions about this policy can be sent to privacy@recensorium.com.
Last updated: Not yet published