Cookie Notice

Effective 2026-10-01 · Version 2026-10-01

What changed in this version

First published Cookie Notice.
Lists every cookie and browser-storage item we use, with its purpose and duration.
Explains that we use no advertising cookies, pixels or third-party analytics cookies.
Explains what Global Privacy Control switches off.

1.In short

Valuein (as identified in the Terms) uses a small number of first-party cookies and browser storage. Most keep you signed in or remember choices you made. Three — vi_ft, vi_persona and vi_vid — help us measure our own marketing and page experiments; they hold a channel name, a page name or a random number, never your name or email, and they are never shared with an advertiser. We use no advertising cookies, no third-party analytics cookies, no pixels and no session replay. If your browser sends Global Privacy Control, we stop setting the three measurement cookies. This summary is not a substitute for the notice below.

2.Cookies

"First party" means set on a valuein.biz domain. "Set by" names the code or service that creates the cookie.

Name	Set by	Purpose	Duration	Party	Category	Effect of GPC
`__Secure-authjs.session-token`	Sign-in (Auth.js)	Keeps you signed in; a signed, encrypted session token holding your user ID and sign-in method	30 days, renewed while you use the Service	First	Strictly necessary	None
`__Host-authjs.csrf-token`	Sign-in (Auth.js)	Protects sign-in forms against cross-site request forgery	Browser session	First	Strictly necessary	None
`__Secure-authjs.callback-url`	Sign-in (Auth.js)	Remembers the page to return to after sign-in	Browser session	First	Strictly necessary	None
`__Secure-authjs.state`, `__Secure-authjs.pkce.code_verifier`, `__Secure-authjs.nonce`	Sign-in (Auth.js), during Google/LinkedIn sign-in only	Secure the OAuth hand-off with Google or LinkedIn	About 15 minutes	First	Strictly necessary	None
`vi_llm_key`	Workspace, when you connect your own AI key	Carries your model key, sealed with AES-GCM; httpOnly, Secure, SameSite=Strict	24 hours, or until you disconnect	First	Strictly necessary (feature you requested)	None
`vi_llm_lane`	Workspace, when you choose Valuein-managed AI	Records that this session uses the managed lane (value `managed`; no secret)	24 hours, or until you switch	First	Strictly necessary (feature you requested)	None
`valuein_ws_ui`	Workspace	Remembers your Workspace layout (classic or chat)	1 year	First	Functional	None
`vi_ft`	Script on every public page	Records the channel and referring site of your first visit (for example `social\|linkedin`); stored on your Account at sign-up so we know which channels bring customers	1 year; never overwritten	First	Analytics (first-party attribution)	Not set or read
`vi_persona`	Script on `/solutions/*` pages	Records the last solutions page you read (a page name only)	30 days	First	Analytics (first-party attribution)	Not set or read
`vi_vid`	Our server, on page requests in scope for experiments	A random 32-character identifier that keeps you in the same version of a page we are testing and links a later sign-up to that version	1 year, renewed on each visit	First	Analytics (first-party experiments)	Not set or read; no experiment exposure recorded

3.Browser storage (local storage and session storage)

These items stay in your browser and are not sent to us automatically, except where noted.

Key (pattern)	Set by	Purpose	Duration	Category	Effect of GPC
`vi_chat_v1`, `vi_chat_sessions_v1`, `vi_chat_active_session_v1`, `vi_chat_tombstones_v1`, `valuein:chat-sync-cursor`	Workspace chat	Your conversations on this device and the state of Cross-Device Sync (copies on our servers are described in the Privacy Policy)	Conversations: 30 days after last use unless pinned; up to 200	Strictly necessary (feature you requested)	None
`vi_report_chat_link_v1`, `valuein:ws-shell-panel-open`, `valuein:ws-shell-panel-mode`, `valuein:ws-shell-doc-id`, `valuein:ws-shell-panel-pct`, `valuein:ws-rail-collapsed`, `valuein:report-review-dock`, `valuein:dashboard-sidebar-collapsed`, report-draft keys, model-choice keys	Workspace	Remember panel layout, the open report, unsaved drafts and your chosen model	Until you clear them	Functional	None
`valuein:ws-first-run-dismissed`, `valuein:setup-card-dismissed`, `valuein:welcome-dismissed`, `valuein:start:*`, `valuein:mcp-tested`, `valuein:data-budget`	Workspace and onboarding	Remember onboarding steps and notices you have dismissed	Until you clear them	Functional	None
`valuein:active-seconds`	Workspace (signed-in)	Total active minutes on this device, so the product survey appears only after real use	Until you clear it	Functional	None
`valuein:pmf-dismissed`, `valuein:pmf-answered`	Workspace (signed-in)	Remember that you dismissed or answered the product survey	Until you clear them	Functional	None
`valuein:session-id` (session storage)	Workspace (signed-in)	A random per-tab identifier sent with a once-a-minute activity heartbeat, so we can measure time spent in the Workspace	Until the tab closes	Analytics (first-party product usage, signed-in only)	None — it applies only to signed-in use of the Service
Other session-storage flags (refresh-on-return, examples prompt, token reveal)	Workspace	Avoid repeating an action within one tab	Until the tab closes	Functional	None

4.Third-party services that run on our pages without cookies

Cloudflare Web Analytics. A script from static.cloudflareinsights.com sends page URL, referrer, browser type and page-performance timings to Cloudflare, which gives us aggregate statistics. It sets no cookies and no local storage, and Cloudflare does not use it to track you across sites. It runs on every page.
Cloudflare Turnstile. On sign-in, sign-up, contact and data-issue forms, Turnstile (loaded from challenges.cloudflare.com in a frame) checks that a person, not a bot, is submitting. Cloudflare's Turnstile Privacy Addendum states that it processes the client IP address, TLS fingerprint, user-agent and site key, that these signals are strictly necessary for bot detection, and that Cloudflare also uses them, as a controller, to improve bot detection. It is strictly necessary for those forms.
Company logos are served from logos.valuein.biz, our own cache. The logo vendor never receives your browser's request.

We do not use Google Analytics, advertising pixels (Meta, LinkedIn Insight, Google Ads), session-replay tools, third-party chat widgets or error-tracking scripts that capture page content.

6.Global Privacy Control

When your browser sends Sec-GPC: 1, we treat it as an opt-out of sale, sharing and targeted advertising (none of which we do), we stop setting and reading vi_ft, vi_persona and vi_vid, and, if you are signed in, we record the preference on your Account. See Privacy Policy Section 13.

7.Your controls

Turn on Global Privacy Control in your browser or with an extension.
Block or delete cookies and site data in your browser settings. Blocking the sign-in cookies means you cannot sign in; blocking vi_llm_key means your own AI key cannot be used; blocking the measurement cookies has no effect on the Service.
Clearing site data for valuein.biz removes the browser copies of your chats; copies held for Cross-Device Sync remain on your Account until you delete them.

8.Changes

If we add a cookie or storage item that is not strictly necessary or functional, we will update this notice before it is used, and treat it as a material change to the Privacy Policy (30 days' notice). Questions: legal@valuein.biz.