// Legal

Cookie and Similar Technologies Policy

Effective and last updated: August 27, 2026

Operator and contact details

Legal operator
Aiviko Team
Service name
Aiviko
Privacy and legal email
support@aiviko.app

1. What this policy covers

This policy explains how Aiviko and named providers use cookies, local storage, session storage, Cache Storage, pixels, tags, and similar storage or access technologies. It should be read with the Privacy Policy.

A cookie is a small value stored by a browser. Similar technologies can remember information or read device data without using a traditional cookie. The same legal rules and applicable choices cover both kinds of technology, although strictly necessary storage, optional Analytics, and advertising do not all use the same legal basis or control.

2. Necessary and requested-function storage

These technologies operate without the optional Analytics choice because they remember privacy settings, provide an interface choice, transfer a user-selected file within the same tab, or cache software that you ask the tool to run. Where storage-access law provides an exemption for strictly necessary or user-requested functions, Aiviko relies on it.

  • "theme" — first-party local storage; remembers light/dark appearance; lasts until cleared.
  • "aiviko.consent.v2" — first-party local storage; records the optional Analytics choice; expires logically after 180 days or earlier if cleared. An obsolete v1 record is removed when encountered.
  • "aiviko.landingHandoff" — first-party session storage; temporarily transfers one selected image to a tool; removed after use/error and normally at the end of the tab session.
  • "aiviko-runtime-assets-v2" — first-party Cache Storage; stores versioned tool runtimes and AI models; lasts until eviction, site-data deletion, or a cache-version change.
  • Ordinary HTTP cache, memory, and security technologies used by the browser, Vercel, or Cloudflare as needed to deliver requested pages and assets. Provider-set security cookies, if enabled, can vary with the production configuration.

3. Analytics

Google Analytics 4 is off until you choose Analytics. When allowed, the Google tag measures pages and interactions and may use first-party cookies such as "_ga" and a property-specific "_ga_<container-id>" to distinguish browsers. Google documents a typical maximum expiration of two years, which may be refreshed by activity or shortened by settings, consent, browser rules, or law.

Aiviko disables Google Signals and ad-personalization signals in the site tag. This does not replace production verification of the Google Analytics account, event payloads, data retention, data sharing, and product-link settings.

4. Advertising

After the operator enables the production compliance gate, Google AdSense loads on ordinary content pages independently of the Analytics choice. A Google-certified consent platform determines whether personalized, non-personalized, limited, or contextual ads may be served. Personalization and non-essential storage or access require the applicable choice or consent.

Google states that limited ads still use an IP address to transmit the ad and may cache creatives. If programmatic demand for limited ads is enabled, Google may also use cookies, local storage, or Shared Storage solely for invalid-traffic detection. The operator must disable that feature wherever it lacks the consent or other legal basis required for that storage or processing.

Names, domains, and durations vary by Google product, vendor, region, browser, and advertising mode. Examples documented by Google include identifiers on Google domains and publisher or partner domains. Use Google's linked cookie information and the certified regional consent message for the current vendor-level details.

5. Providers

Vercel hosts the application. Cloudflare delivers Aiviko CDN assets and may provide configured security or caching. Google provides Analytics and AdSense. Hugging Face and jsDelivr deliver certain model or runtime assets. These providers may receive request data even when they do not set a browser cookie.

The provider privacy links below are part of the transparency information. Production must be audited after any provider, domain, proxy, tag, ad-vendor, Cloudflare feature, or consent-platform change.

6. Your choices

On your first visit, choose Continue without analytics, Allow analytics, or Manage. The Aiviko panel controls optional Analytics. Continuing without Analytics does not block the core browser tools, but limited or contextual ads may remain. Reopen the fixed Privacy choices control at any time to change or withdraw Analytics consent with the same ease as granting it.

Withdrawing Analytics consent stops future Analytics tag loading and reloads the page when needed. Use Manage Google advertising choices to reopen Google's certified advertising-choice flow. Withdrawal does not make earlier consent-based processing unlawful and does not automatically erase data already held by a provider; use provider controls or send a rights request where applicable.

Browser controls can also block or delete site data. Doing so may reset theme and consent choices, remove a pending handoff, clear cached models, and cause the banner or downloads to appear again.

7. Global Privacy Control and regional messages

Aiviko treats a browser Global Privacy Control signal as an opt-out of personalized or targeted advertising for that browser. It does not necessarily remove limited or contextual ads. Analytics remains a separate opt-in choice. Do Not Track has no universally accepted legal or technical meaning, so Aiviko does not currently respond to it unless law requires otherwise.

For the EEA, UK, Switzerland, and other regions where Google requires it, Aiviko must deploy a Google-certified consent management platform and honor its granular vendor and purpose signals in addition to this panel. For applicable U.S. states, production advertising settings must honor required opt-out, restricted-data-processing, and universal opt-out signals.

8. Duration and review

Durations for Aiviko's first-party storage are listed in Section 2. Google and infrastructure-provider durations are controlled by their current settings and notices. Session technologies generally end with the tab or browser session; persistent technologies remain until expiry, replacement, eviction, or deletion.

Consent is requested again after 180 days and sooner if the purposes or providers materially change. The operator should run a live cookie and network scan before launch and periodically afterward; this policy must be updated if the observed production behavior differs.

9. Changes

Aiviko may update this policy when technologies, providers, purposes, or law change. Material changes will receive notice and renewed consent where required.

10. Contact

Questions or requests about cookies and similar technologies can be sent to the operator contact listed above.