Legal
Cookie and Browser Storage Policy
- Effective date
- 2026-08-20
- Last updated
- 2026-08-20
- Document version
- 2026-08-20.1
- Product
- Precision Foundry
1. Introduction
Precision Foundry uses cookies and similar browser technologies to operate and secure the Service, keep users signed in, remember the organization workspace they selected, and store interface preferences. This Policy explains what these technologies do and the choices available to you.
This Policy reflects technologies implemented in the current application and related providers. Effective date: 2026-08-20.
Related documents: Privacy Policy (/privacy), Terms of Service (/terms), AI Data Disclosure (/ai-data), and Cancellation Policy (/cancellation).
3. How Precision Foundry uses cookies
Precision Foundry uses cookies and browser storage to:
- Authenticate users and maintain a secure signed-in session (Auth.js / NextAuth with a JWT session strategy).
- Protect authentication flows with CSRF and safe post-login redirects.
- Remember which organization workspace is active (pf_active_company_id).
- Remember light, dark, or system theme preference (localStorage key: theme).
- Hold short-lived UI state for certain authenticated workflows (sessionStorage).
- Enable subscription checkout and billing management through Stripe-hosted pages when you request those features.
- Measure public marketing-page traffic with Google Analytics after you accept optional analytics cookies.
4. Strictly necessary cookies
Strictly necessary cookies support essential functions such as authentication, session security, fraud prevention, organization selection, and subscription management. Precision Foundry cannot provide some requested features without these technologies.
Strictly necessary cookies used by the application are not blocked behind a consent banner. Blocking them in your browser may prevent core features from working.
5. Functional browser storage
Precision Foundry stores a small amount of functional data in the browser that is not used for advertising or cross-site tracking:
- theme in localStorage — light, dark, or system preference only.
- issue-discovery-last-provider:{issueId} in sessionStorage — temporary AI vs heuristic result-source hint during issue discovery, removed after it is read.
Legal consent at signup or checkout is recorded in the application database (with document versions and request IP where available). It is not stored as a browser cookie or localStorage entry.
6. Third-party services
When you open Stripe Checkout or the Stripe customer portal, you leave Precision Foundry's application interface and interact with a Stripe-hosted service. Stripe may use cookies and similar technologies for payment processing, authentication, fraud prevention, security, and service operation. Stripe's use of those technologies is governed by Stripe's own privacy and cookie disclosures.
Precision Foundry does not control Stripe's cookies. Hosting (for example, Vercel) and other infrastructure providers may process technical request metadata in platform logs; this Policy does not claim additional first-party marketing cookies from those platforms unless listed in the inventory table below.
Public marketing pages include Google's gtag.js tag with analytics storage denied by default. After you accept optional analytics cookies, Precision Foundry grants analytics storage and may set first-party Google Analytics cookies on the Precision Foundry domain. Page URLs, approximate location, and device/browser metadata may then be sent to Google LLC. That tag is not loaded on signed-in application pages.
7. Analytics and advertising cookies
Precision Foundry does not currently use advertising cookies or cookies for cross-site behavioral tracking. On public marketing pages, the Google tag may be present so your choice can be honored. Analytics cookies and measurement run only after you accept optional analytics cookies. If you reject optional cookies or make no choice, analytics storage stays denied. The tag is not loaded on signed-in application pages.
8. How you can control cookies
Most browsers allow you to view, delete, or block cookies and stored website data. Blocking strictly necessary cookies may prevent you from signing in, selecting an organization, maintaining a secure session, or using billing features. Browser controls vary, so consult your browser's help documentation for instructions.
You can also clear localStorage and sessionStorage for this site through your browser's site-data or storage settings. Clearing the theme preference returns the interface to the default system theme until you choose again.
Public pages show an optional-cookie consent banner for Google Analytics. You can accept or reject optional analytics cookies, and change that choice later using Cookie Settings in the public footer. Strictly necessary cookies are not gated behind consent.
9. Consequences of blocking required cookies
If you block or delete strictly necessary cookies:
- You may be unable to sign in or stay signed in.
- Organization workspace selection may not persist.
- CSRF protection or safe redirects during authentication may fail.
- Stripe Checkout or the customer portal may not complete if Stripe's required cookies are blocked on Stripe-hosted pages.
10. Cookie and browser storage inventory
The following table lists cookies and similar technologies identified in the current Precision Foundry application and billing redirects. Auth.js production names below assume HTTPS; development over HTTP uses the same names without the __Secure- or __Host- prefixes.
| Name or technology | Provider | Purpose | Classification | Storage type | Duration |
|---|---|---|---|---|---|
| __Secure-authjs.session-token (development: authjs.session-token) | Precision Foundry / Auth.js | Keeps you signed in using a JWT session cookie after authentication. | strictly necessary | HTTP cookie | About 30 days of inactivity by Auth.js default (session.maxAge); HttpOnly; SameSite=Lax; Secure on HTTPS |
| __Host-authjs.csrf-token (development: authjs.csrf-token) | Precision Foundry / Auth.js | Protects authentication-related requests against cross-site request forgery. | strictly necessary | HTTP cookie | Session cookie (no fixed maxAge in Auth.js defaults); HttpOnly; SameSite=Lax; Secure and __Host-prefixed on HTTPS |
| __Secure-authjs.callback-url (development: authjs.callback-url) | Precision Foundry / Auth.js | Stores a safe same-origin redirect path after sign-in so users return to the page they requested. | strictly necessary | HTTP cookie | Session cookie (no fixed maxAge in Auth.js defaults); HttpOnly; SameSite=Lax; Secure on HTTPS |
| pf_active_company_id | Precision Foundry | Remembers the active organization workspace so the Service can load the correct company context. | strictly necessary | HTTP cookie | 1 year (maxAge 31,536,000 seconds); HttpOnly; SameSite=Lax; Secure in production |
| theme | Precision Foundry (next-themes) | Remembers light, dark, or system interface theme. Stores only the preference value (light, dark, or system)—not a name, email, or other personal profile data. | functional | localStorage | Persists until cleared by you or the browser |
| issue-discovery-last-provider:{issueId} | Precision Foundry | Temporarily remembers whether the last issue-discovery question generation used OpenAI or a local heuristic so the UI can show the result source after a page reload. Cleared after read. | functional | sessionStorage | Until tab/session end, or removed immediately after the page reloads and reads the value |
| _ga | Google Analytics | Distinguishes public-site visitors so Google Analytics can report traffic. Set only after optional analytics cookies are accepted. Not used on signed-in application pages. | optional analytics | HTTP cookie | Up to 2 years; first-party cookie on the Precision Foundry domain |
| _ga_* (for example, _ga_6G9ML0TTE6) | Google Analytics | Persists the Google Analytics 4 session state for the public-site measurement stream. Set only after optional analytics cookies are accepted. | optional analytics | HTTP cookie | Up to 2 years; first-party cookie on the Precision Foundry domain |
| Stripe-hosted Checkout and Customer Portal cookies | Stripe | Payment processing, authentication to Stripe-hosted billing pages, fraud prevention, security, and service operation when you open Checkout or the customer portal. | necessary for user-requested billing | third-party (Stripe-hosted) | Set and controlled by Stripe on stripe.com (or Stripe-hosted) pages—not by Precision Foundry |
Auth.js also defines short-lived OAuth/WebAuthn helper cookies (for example, PKCE, state, nonce, or WebAuthn challenge) in its library defaults. Precision Foundry currently configures a Credentials provider only, so those helper cookies are not expected in normal production use. If additional sign-in providers are added later, this inventory will be updated.
11. Policy changes
We may update this Policy when we change how cookies or browser storage are used. Material changes will be reflected by updating the effective date and document version on this page. If additional optional analytics, advertising, session-replay, or similar technologies are introduced, we will update this Policy and provide consent choices where required.
12. Contact information
Privacy questions: privacy@precisionfoundry.io
General support: support@precisionfoundry.io
Tools by Design Development Group, LLC · Precision Foundry