Clox← back
03
legal · cookie policy

What we store on your device, and why.

A plain-language inventory of every cookie and similar local-storage entry Clox uses, grouped by category. You can change your consent at any time from the footer.

effective · November 2026

01

What we mean by "cookies"

When we say “cookies” we mean cookies in the strict sense plus other client-side storage like localStorage, sessionStorage, and IndexedDB — the same compliance principles apply. Cookies set by clox.studio are first-party. Anything set by a service provider (such as Stripe checkout pages) is a third-party cookie governed by their own policy.

02

The four categories we use

Each cookie or similar entry falls into exactly one of these categories. Necessary cookies cannot be turned off because the workspace literally won’t function without them. Everything else is optional and off until you opt in.

  • Strictly necessary. These keep you signed in, protect your account, store the chats and projects you work on, and remember settings you choose yourself such as theme and language. They are exempt from consent under the ePrivacy Directive and equivalent rules, because the service cannot work, or cannot do what you asked, without them.
  • Functional. Optional storage that makes repeat visits smoother without being needed for what you asked. Nothing in this category is set today; if we add something it will be listed here and stays off until you turn it on.
  • Analytics. With your consent we load Vercel Web Analytics and Speed Insights. They count page views and measure loading speed without cookies or a persistent identifier, and we strip anything private (sign-in links, invite codes, query strings) from addresses before they are sent. The data is never sold or used for advertising.
  • Marketing. We do not run advertising or conversion pixels today. If we ever do, they will only load after you opt in here, and Global Privacy Control will always switch them off as an opt-out of sale or sharing.
03

Everything we store or load

This list is generated from the same register the cookie banner uses, so it always matches what the site actually does. Entries ending in * cover a family of keys (for example one per chat).

Strictly necessary

  • sb-*
    cookie · Clox (Supabase Auth)
    Keeps you signed in and refreshes your session securely.
    Until you sign out, refreshed while active
  • clox_consent
    cookie · Clox
    Remembers your cookie choices so every page and tab follows them.
    6 months
  • clox_region
    cookie · Clox
    Country-level hint (never your address) that decides which privacy rules and wording apply.
    Browser session
  • clox.consent.v2
    localStorage · Clox
    Copy of your cookie choices with the date and a consent ID you can quote.
    6 months
  • chat-history-*
    localStorage · Clox
    Messages of chats you open, so they load instantly and survive a reload.
    Until you delete the chat
  • chat-settings-*
    localStorage · Clox
    Model and options you picked for each chat.
    Until you delete the chat
  • activeChatId*
    localStorage · Clox
    Which chat was open, so you return to it.
    Until replaced
  • clox_chats
    localStorage · Clox
    Your chat list for offline and fast loading.
    Until you delete chats
  • sidebar-chats
    localStorage · Clox
    Chats shown in the sidebar.
    Until you delete chats
  • deleted-items
    localStorage · Clox
    Items you moved to Archives, so they stay hidden.
    Until you restore or delete them
  • project-settings-*
    localStorage · Clox
    Settings of projects you work in.
    Until you delete the project
  • project-db-id-*
    localStorage · Clox
    Links a chat to its saved project.
    Until you delete the chat
  • clox.preview.*
    localStorage · Clox
    Artifact previews you opened.
    Until replaced
  • clox.profile.tick
    localStorage · Clox
    Tells other open tabs your profile changed.
    Moments
  • clox:toolsState
    localStorage · Clox
    Tools you switched on in the composer.
    Until changed
  • selected*ModelId
    localStorage · Clox
    The text, image, video and audio models you chose.
    Until changed
  • clox-palette
    localStorage · Clox
    The theme you chose, applied before the page paints.
    Until changed
  • theme
    localStorage · Clox
    Older copy of your light / dark choice.
    Until changed
  • clox.language
    localStorage · Clox
    The language you chose.
    Until changed

Functional

Nothing in this category is in use right now.

Analytics

  • Vercel Web Analytics
    script · Vercel
    Counts page views and referrers. No cookies, no cross-site identifier; private parts of addresses removed.
    No storage on your device
  • Vercel Speed Insights
    script · Vercel
    Measures how fast pages load and respond (Core Web Vitals).
    No storage on your device

Marketing

Nothing in this category is in use right now.

05

GPC and other browser signals

We honour the Global Privacy Control (GPC) signal as a binding opt-out of the “sale or sharing” of personal information under California’s CCPA / CPRA and the corresponding rules in Colorado and Connecticut. If your browser sends GPC, we keep everything optional off, don’t show the consent banner, and marketing can never be switched back on while the signal is present.

We also honour the legacy Do Not Track (DNT) header in the same way, even though most browsers have moved to GPC.