AI.FO LEGAL
Cookie Policy
Last updated: October 5, 2026
This Cookie Policy explains how AI.FO uses cookies and similar local browser storage, why we use them, and how you can control them. It should be read together with our Privacy Policy.
1. What cookies and local storage are
Cookies are small text files a site can store in your browser. "Local storage" is a related browser mechanism that lets an application keep small amounts of data on your device. We use these terms together in this policy to describe the ways AI.FO keeps information in your browser so the Service can work.
2. How we use them
AI.FO uses cookies and local storage primarily to operate the Service. We do not use them for advertising, and we do not sell information collected through them.
| Category | Purpose |
|---|---|
| Strictly necessary | Keep you signed in, maintain your session, and protect the security of your account. The Service cannot function without these. |
The specific cookie the Service sets and the browser storage keys it uses are itemized below. The list is checked automatically against the Service's source, so a key cannot be added to the Service without appearing here.
| Cookie | Set by | Purpose | Attributes | Lifetime |
|---|---|---|---|---|
connect.sid | Sign-in and registration responses | Keeps you signed in. The server holds the session; this cookie holds only its id. | HttpOnly; Secure (production); SameSite=Lax | 7 days |
| Browser storage key | Store | Purpose | Lifetime |
|---|---|---|---|
aifo.processing.pending | sessionStorage | Remembers an unfinished analysis request so trying again does not run it twice. Does not store your reports or form answers. | Per tab; cleared when analysis succeeds or the tab closes |
aifo_public_diagnostic_session | sessionStorage | The temporary token for a free-diagnostic upload made without an account, so the result page can read it back. | Per tab; the server purges the session within 24 hours regardless |
aifo.returnTo | sessionStorage | The in-app page to return to after sign-in. | Per tab; cleared on use |
aifo.assessmentContinuity | sessionStorage | Marks that a signup began from the free assessment, so the guided setup can reference it. Holds only the assessment check counts, never your email or the assessment token. | Per tab; cleared when the orientation is dismissed or when the tab closes |
aifo.checkout.pending | sessionStorage | Marks a checkout started from this tab so the return page can confirm its outcome. | Per tab; cleared when the outcome is known |
aifo.decision.pendingOrigin | sessionStorage | Carries the signal a decision is being recorded from into the decision ledger, including which preview ranking it came from when the comparison panel started it. | Per tab; cleared on use |
aifo.plaid.oauthPending | sessionStorage | Holds a bank connection you started, so AI.FO can finish it when your bank sends you back. Stores the short-lived Plaid Link token and which account and company it's for, never your bank sign-in or bank data. | Per tab; cleared when the connection finishes, fails, or is cancelled, when you sign out, and never kept longer than 30 minutes |
aifo.platform.create-client-draft | sessionStorage | Platform-owner console: an unsent draft of the create-client form. | Per tab; cleared on submit or when the tab closes |
auth_token | localStorage | Read-only compatibility path from an earlier build: if present it is sent as a sign-in header. Nothing in the current Service writes it. | Not written by the Service |
Nothing above is sent to a third party or used for advertising or cross-site tracking.
3. Cookies set by our providers
Some functionality relies on the sub-processors described in our Privacy Policy (for example, payment processing and hosting). Those providers may set their own cookies when their functionality is used, subject to their own policies.
- Stripe (checkout.stripe.com, billing.stripe.com): When you open Checkout or the Customer Portal, which are Stripe-hosted pages. Stripe's hosted pages set their own cookies on Stripe's domain under Stripe's Cookies Policy, which names __stripe_mid and __stripe_sid (essential and fraud-prevention cookies) and lists durations in Stripe's consent dashboard. The Service loads no Stripe script on its own pages.
- Replit (hosting): On every page, as the host of the site and the API. No cookie set by the hosting layer is observed on the Service's responses; if Replit changes that, this row changes with it.
Our marketing site (getaifo.com)
Our marketing site at getaifo.com is a separate site from the AI.FO app. Everything above describes the app; the items below apply only to the marketing site. The Privacy Policy explains what is recorded and how to opt out.
- Apollo.io (assets.apollo.io): getaifo.com (marketing site only). Apollo's script stores a random visitor ID in your browser and records your IP address, the pages you view and your browser details, so Apollo can help us understand which companies visit. We use this only for B2B sales outreach. It never runs inside the AI.FO app. To opt out, use the "Do not sell or share my information" link on getaifo.com, or email privacy@getaifo.com.
- aifo_optout (first-party cookie): getaifo.com (marketing site only). Set when you turn off Apollo with the "Do not sell or share my information" link or choose "Decline" in our banner. Kept for one year so Apollo does not load in that browser.
- aifo_consent (first-party cookie): getaifo.com (marketing site only). Set when you choose "Accept" in our banner, which is shown only to visitors from the European Union, the European Economic Area or the United Kingdom. Kept for one year so Apollo loads on later visits.
4. Managing cookies
You can control and delete cookies through your browser settings, and clear local storage the same way. Because our strictly necessary cookies and storage are what keep you signed in and secure your session, blocking or deleting them will prevent you from logging in or using core parts of the Service.
5. Changes to this policy
We may update this Cookie Policy from time to time. When we do, we will revise the "Last updated" date above.
Contact us
Questions about this Cookie Policy can be sent to legal@getaifo.com.