Cookie Policy
Effective: March 16, 2026Last updated: July 3, 2026
1. What Are Cookies
Cookies are small text files that a website places on your device when you visit. They are widely used to make websites work, improve efficiency, and provide information to site operators. Local storage is a similar browser technology that allows websites to store data on your device without an expiration date.
This policy explains what cookies and local storage Heurista uses, why we use them, and how you can manage them.
2. How We Use Cookies
Heurista uses strictly necessary cookies and functional browser storage that are essential to signing in and running the platform. Subject to your cookie preferences, we also use analytics and advertising cookies to understand how our website is used and to measure our marketing.
For visitors in the European Economic Area (EEA) and the United Kingdom, analytics and advertising cookies are not set until you agree to them: they are disabled by default and only enabled if you select "Accept" in our cookie banner. Outside the EEA and UK they may be enabled by default, and you can opt out at any time. You can change your choice whenever you like using the "Cookie settings" link in the footer.
3. Cookies and Storage We Use
| Name | Type | Purpose | Duration | Data Stored |
|---|---|---|---|---|
| survey-session | Strictly Necessary | Maintains your authenticated session so you stay logged in as you navigate the platform. | 7 days | Login status, user role, username, organization ID and name |
| oauth_state | Strictly Necessary | Prevents cross-site request forgery (CSRF) during OAuth login flows (Google, Microsoft, GitHub). | 10 minutes | Random state token |
| oauth_code_verifier | Strictly Necessary | Part of the PKCE security protocol for OAuth authentication. | 10 minutes | Random code verifier |
| hue-state | Functional (localStorage) | Preserves your Hue AI assistant conversation and panel state between page navigations. | Until cleared | Panel open/close state, chat history (up to 30 messages) |
| heurista-welcome-seen | Functional (localStorage) | Remembers that you have already seen the welcome modal so it is not shown again. | Until cleared | Boolean flag |
| _ga | Analytics (consent required) | Google Analytics — distinguishes unique visitors to measure site usage. In the EEA/UK, set only after you accept analytics cookies; elsewhere, set by default and blocked if you opt out via Cookie settings. | Up to 2 years | Randomly generated client identifier |
| _ga_<id> | Analytics (consent required) | Google Analytics 4 — persists session state for the measurement property. In the EEA/UK, set only after you accept analytics cookies; elsewhere, set by default and blocked if you opt out via Cookie settings. | Up to 2 years | Session and campaign state |
| _gcl_au (and related _gcl_* cookies) | Advertising (consent required) | Google Ads / Conversion Linker — measures ad-driven conversions across heurista.ai and app.heurista.ai. In the EEA/UK, set only after you accept advertising cookies; elsewhere, set by default and blocked if you opt out via Cookie settings. | 90 days | Ad-click identifier for conversion attribution |
| heurista_consent | Strictly Necessary | Records your cookie consent choice so we can honor it and avoid re-prompting across heurista.ai and app.heurista.ai. | 13 months | Consent status (granted/denied) and version |
4. Strictly Necessary Cookies
The survey-session, oauth_state, and oauth_code_verifier cookies are required for the platform to function. They handle authentication and security during login. These cookies are encrypted using AES-256 (iron-session) and set with httpOnly and secure flags, meaning they cannot be read by JavaScript and are only transmitted over HTTPS in production.
Because these cookies are essential to authentication and security, they cannot be opted out of while using the platform.
5. Functional Storage
Heurista uses browser local storage (not cookies) for two items that improve your experience: preserving your AI assistant conversation history and remembering that you have dismissed the welcome modal.
These items never leave your browser. They are not sent to our servers and are not used for tracking. You can clear them at any time through your browser's developer tools or storage settings. Chat history stored in browser localStorage is automatically cleared when you sign out. We recommend using private/incognito browsing when accessing the platform on shared devices.
These browser storage items improve your experience but are not essential for the core service to function. Under strict interpretations of the ePrivacy Directive, such functional storage may require consent. We minimize our use of browser storage and do not use it for tracking or advertising purposes.
6. Third-Party and Analytics Cookies
Subject to your cookie preferences, Heurista uses Google Analytics 4 and Google Ads, loaded through Google Tag Manager, to measure website traffic and the performance of our marketing. These services set first-party cookies (such as _ga, _ga_<id>, and _gcl_au) on the heurista.ai domain and share data with Google. We have enabled Google Consent Mode v2, so these tags respect your choice: in the EEA and UK they load in a consent-denied state by default and only set cookies after you accept.
We also use Vercel Web Analytics and Vercel Speed Insights to measure aggregate traffic and page performance. These are cookieless — they do not set cookies or store a persistent identifier on your device.
When you sign in using Google, Microsoft, or GitHub, those providers may set their own cookies on their respective domains during the authentication redirect. These cookies are governed by each provider's own cookie and privacy policies and are not set or controlled by Heurista.
If you proceed to payment checkout, Stripe (our payment processor) may set cookies on the stripe.com domain to process your payment securely. These cookies are governed by Stripe's privacy policy.
7. Your Choices
Most browsers allow you to manage cookies through their settings. You can typically find these options under "Privacy," "Security," or "Cookies" in your browser preferences.
If you block or delete the survey-session cookie, you will be unable to log in to Heurista. The OAuth cookies are temporary and only exist for 10 minutes during the login process.
Clearing local storage will reset your Hue AI conversation history and cause the welcome modal to appear again, but will not affect your account or data.
You can accept or reject analytics and advertising cookies at any time using the "Cookie settings" link in the website footer, which re-opens the consent banner. Rejecting them withdraws your consent and stops these cookies from being set going forward; cookies already stored can be cleared through your browser settings.
8. Do Not Track and Global Privacy Control
Because analytics and advertising cookies are governed by the consent banner described above — off by default in the EEA and UK, and adjustable anywhere via "Cookie settings" — we do not separately respond to the legacy "Do Not Track" (DNT) browser signal, which lacks a common standard. We do, however, honor the Global Privacy Control (GPC) signal: if your browser or an extension sends GPC, we treat it as a request to disable analytics and advertising cookies. Strictly necessary cookies remain required for the platform to function.
9. Changes to This Policy
We may update this Cookie Policy from time to time. If we make material changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically.
10. Contact
If you have questions about this Cookie Policy, contact us at [email protected].
Development Institute LLC d/b/a Heurista, 1834 Connecticut Ave NW, Washington, DC 20009, United States.