Cookie policy
The seven cookies and six browser-storage entries haarness.ai uses, all strictly necessary or set by your own choice — and no tracking.
Cookie policy
haarness.ai uses a small number of cookies and browser-storage entries, all of which are either strictly necessary to sign you in and keep your account secure, or remember a choice you made. There are no analytics, advertising, social-media or other third-party cookies, and the site loads no third-party scripts, fonts or trackers. That is why there is no cookie banner: the law does not require consent for these, and there is nothing else to consent to.
Cookies
All seven are set by haarness.ai itself (first-party), sent only over HTTPS in production, and
restricted to same-site requests (SameSite=Lax).
| Name | Purpose | Lifetime | Readable by page scripts |
|---|---|---|---|
hc_session |
Keeps you signed in. Holds a random session token; we store only its hash | Up to 30 days, or until you sign out | No (HttpOnly) |
hc_csrf |
Protects your account against cross-site request forgery: the web app sends it back with every change you make | Same as hc_session |
Yes — that is how it works |
hc_login_state |
Ties a Google or Apple sign-in, or connecting Google or Apple in Settings, to the browser that started it, so another site cannot complete it for you | 10 minutes, removed when sign-in finishes | No (HttpOnly) |
hc_email |
Ties a sign-in email to the browser that asked for it: its code only works there, and its link signs in there without asking first | 30 minutes, removed when sign-in finishes | No (HttpOnly) |
hc_link |
When you first continue with Google or Apple using an address that already has a Haarness account, remembers that sign-in while you sign in to the existing account, which then gains it | 15 minutes, removed when sign-in finishes | No (HttpOnly) |
hc_mfa |
Remembers a sign-in that is waiting for your two-factor code | 10 minutes, removed when sign-in finishes | No (HttpOnly) |
hc_mfa_trust |
Lets this browser skip the two-factor code, when you choose Trust this browser | 30 days, or until you sign out everywhere or forget trusted browsers | No (HttpOnly) |
Signing out deletes hc_session and hc_csrf.
Browser storage
The web app also keeps these entries in your browser's local storage. They never leave your device and are not sent to us.
| Key | Purpose | Lifetime |
|---|---|---|
haarness.theme |
Light, dark or system appearance | Until you clear site data |
haarness.language |
The interface language you picked | Until you clear site data |
haarness.chat.tools |
Whether the tool-activity panel is open in workspace chat | Until you clear site data |
haarness.sidebar.collapsed |
Whether the sidebar is collapsed to icons | Until you clear site data |
haarness.cloud.account |
The team you picked in the account switcher | Until you switch back to your personal account |
haarness.signInEmail |
The email address you typed when asking for a password-reset link, so the sign-in form can fill it in after you open the link | Until you open the link or sign in with a password in this browser |
Other parties
- Google sign-in. If you choose Continue with Google, you are sent to Google's own sign-in page, which sets Google's cookies under Google's policies.
- Checkout. Payments open Stripe's hosted checkout on Stripe's own domain, which uses cookies for fraud prevention under Stripe's cookie policy.
Neither sets cookies on haarness.ai.
Managing cookies
You can delete or block cookies in your browser settings. Blocking hc_session, hc_csrf,
hc_login_state, hc_email, hc_link or hc_mfa stops you from signing in; the public pages keep working. Clearing site data
resets your theme and language to the defaults.
If we ever add a cookie that is not strictly necessary, we will ask for your consent first and update this page before it is set.
Questions: [email protected]