Cookie Policy
Cookies and browser storage used by AI Blueprint, their purposes and durations, and your controls.
Essential-cookie inventory
| Name/pattern | Type | Domain/provider | Purpose | Category | Duration | Party | Status |
|---|---|---|---|---|---|---|---|
| __Host-authjs.csrf-token | Cookie | Active AI Blueprint domain / Auth.js | Prevent forged authentication requests | Essential | Refreshed with the authentication flow | First | Required |
| __Secure-authjs.callback-url | Cookie | Active AI Blueprint domain / Auth.js | Return the user to the requested page after sign-in | Essential | Until sign-in completes or it is cleared | First | Required |
| __Secure-authjs.session-token (may be split into multiple cookies) | HttpOnly cookie | Active AI Blueprint domain / Auth.js | Maintain an encrypted/signed login session | Essential | Until session expiry, logout, or revocation | First | Required after sign-in |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | Temporary HttpOnly cookie | Active AI Blueprint domain / Auth.js | Protect Google OAuth; created only when Google is selected | Essential | Until the flow completes or expires | First | Required for Google OAuth |
| control_room_session_v1 | HttpOnly cookie | The active AI Blueprint domain | Separate back-office Control Room session | Essential | Up to 8 hours, logout, or revocation | First | Required for staff |
| __Host-aibp-free-trial-v1 (development: aibp-free-trial-v1) | HttpOnly cookie | The active AI Blueprint domain | Carry a random draft token so a landing-page trial idea can be claimed by a newly verified account; the idea itself is not stored in the cookie | Essential for selected flow | Up to 7 days, until claimed, expired, or cleared | First | Optional—free trial only |
| __Host-aibp-visitor-v1 (development: aibp-visitor-v1) | HttpOnly cookie | The active AI Blueprint domain | Prevent duplicate unique-visitor counts on the same day; the server stores only a per-day digest, never the cookie value | Limited first-party measurement | 400 days or until the cookie is cleared | First | Active |
| Google cookies on Google domains | Cookie | accounts.google.com / Google | Google sign-in after the user chooses Google | Essential for selected flow | Google policy | Third | Optional—Google OAuth only |
| Midtrans cookie/storage on Midtrans domains | Third-party cookie/storage | app.midtrans.com / Midtrans | Display and secure checkout after the user opens it | Essential for selected flow | Midtrans policy | Third | Optional—checkout only |
| PayPal cookie/storage on PayPal domains | Third-party cookie/storage | paypal.com / PayPal | Display, authenticate, and secure USD checkout after the user opens it | Essential for selected flow | PayPal policy | Third | Optional—USD checkout only |
| Hosting routing/security cookie, if set | Cookie | Hosting infrastructure | Routing, TLS, abuse mitigation, and reliability | Essential | Session or configured infrastructure duration | First | Required if set by platform |
Browser-storage inventory
The current product code does not store Blueprint drafts or conversation content in browser storage. Work data is stored server-side after a request is accepted.
| Key | Type | Domain/provider | Purpose | Category | Duration | Party | Status |
|---|---|---|---|---|---|---|---|
| ai-blueprint-theme | localStorage | The active AI Blueprint domain | Theme preference | Preference | Until changed or storage is cleared | First | Active |
| aiblueprint-ui-locale | localStorage | The active AI Blueprint domain | Public-interface language | Preference | Until changed or storage is cleared | First | Active |
| ai-blueprint.workspace-locale | localStorage | The active AI Blueprint domain | Workspace language | Preference | Until changed or storage is cleared | First | Active |
| aiblueprint-lang | localStorage | The active AI Blueprint domain | Language-preference compatibility | Preference | Until changed or storage is cleared | First | Active |
| ai_blueprint_cookie_consent_v1 | localStorage | The active AI Blueprint domain | Policy version, categories, and choice timestamp | Essential/preference | Until policy changes or storage is cleared | First | Active |
Security attributes
In production, sensitive Auth.js cookies use Secure/Host prefixes and server-only session/transient cookies use HttpOnly, Secure, and SameSite appropriate to the flow. control_room_session_v1 uses HttpOnly, Secure, SameSite=Lax, path /, an eight-hour maximum, and server-side revocation. The free-trial and visitor-measurement cookies use HttpOnly, Secure, SameSite=Lax, path /, a production __Host prefix, and contain only random tokens; the idea and account identity remain server-side. localStorage preferences are JavaScript-readable and are not HttpOnly. Logout and relevant security events invalidate sessions server-side.
Google and payment providers
Choosing Google OAuth or opening Midtrans/PayPal checkout may let their domains set cookies under their own policies. AI Blueprint cannot read cookies available only on a third-party domain. AI Blueprint sessions on aiblueprint.web.id and aiblueprintapp.com are separate because secure cookies are scoped to each domain.
Visitor measurement and marketing
We run an aggregate first-party visitor count for Control Room operational reporting. The server does not store an IP address, account, page URL, referrer, interaction content, or an identifier that can be compared across days; the random cookie token becomes a different digest each day solely to prevent same-day duplicate counts. No third-party analytics script, advertising pixel, or cross-site marketing cookie is loaded.
Changing or withdrawing choices
Open Cookie Settings in the footer at any time. Saving records the version and time on this device. You may also clear browser storage. Blocking essential cookies can break login, Google OAuth, request security, or checkout.
Changes and contact
If new analytics, marketing, or storage is added, the policy and dialog will be updated before activation and consent obtained where required. Requests can be submitted without signing in through hello@aiblueprint.web.id or the Contact page. Do not send passwords, API keys, OTPs, or full payment details.