Cookie Policy
Cookies and browser storage used by AI Blueprint, their purposes and durations, and your controls.
Essential-cookie inventory
| Name/pattern | Type | Domain/provider | Purpose | Category | Duration | Party | Status |
|---|---|---|---|---|---|---|---|
| __Host-authjs.csrf-token | Cookie | aiblueprint.web.id / Auth.js | Prevent forged authentication requests | Essential | Refreshed with the authentication flow | First | Required |
| __Secure-authjs.callback-url | Cookie | aiblueprint.web.id / Auth.js | Return the user to the requested page after sign-in | Essential | Until sign-in completes or it is cleared | First | Required |
| __Secure-authjs.session-token (may be split into multiple cookies) | HttpOnly cookie | aiblueprint.web.id / Auth.js | Maintain an encrypted/signed login session | Essential | Until session expiry, logout, or revocation | First | Required after sign-in |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | Temporary HttpOnly cookie | aiblueprint.web.id / Auth.js | Protect Google OAuth; created only when Google is selected | Essential | Until the flow completes or expires | First | Required for Google OAuth |
| control_room_session_v1 | HttpOnly cookie | aiblueprint.web.id / AI Blueprint | Separate back-office Control Room session | Essential | Up to 8 hours, logout, or revocation | First | Required for staff |
| Google cookies on Google domains | Cookie | accounts.google.com / Google | Google sign-in after the user chooses Google | Essential for selected flow | Google policy | Third | Optional—Google OAuth only |
| Midtrans cookie/storage on Midtrans domains | Third-party cookie/storage | app.midtrans.com / Midtrans | Display and secure checkout after the user opens it | Essential for selected flow | Midtrans policy | Third | Optional—checkout only |
| Hosting routing/security cookie, if set | Cookie | Hosting infrastructure | Routing, TLS, abuse mitigation, and reliability | Essential | Session or configured infrastructure duration | First | Required if set by platform |
Browser-storage inventory
The current product code does not store Blueprint drafts or conversation content in browser storage. Work data is stored server-side after a request is accepted.
| Key | Type | Domain/provider | Purpose | Category | Duration | Party | Status |
|---|---|---|---|---|---|---|---|
| ai-blueprint-theme | localStorage | aiblueprint.web.id / AI Blueprint | Theme preference | Preference | Until changed or storage is cleared | First | Active |
| aiblueprint-ui-locale | localStorage | aiblueprint.web.id / AI Blueprint | Public-interface language | Preference | Until changed or storage is cleared | First | Active |
| ai-blueprint.workspace-locale | localStorage | aiblueprint.web.id / AI Blueprint | Workspace language | Preference | Until changed or storage is cleared | First | Active |
| aiblueprint-lang | localStorage | aiblueprint.web.id / AI Blueprint | Language-preference compatibility | Preference | Until changed or storage is cleared | First | Active |
| ai_blueprint_cookie_consent_v1 | localStorage | aiblueprint.web.id / AI Blueprint | Policy version, categories, and choice timestamp | Essential/preference | Until policy changes or storage is cleared | First | Active |
Security attributes
In production, sensitive Auth.js cookies use Secure/Host prefixes and server-only session/transient cookies use HttpOnly, Secure, and SameSite appropriate to the flow. control_room_session_v1 uses HttpOnly, Secure, SameSite=Lax, path /, an eight-hour maximum, and server-side revocation. localStorage preferences are JavaScript-readable and are not HttpOnly. Logout and relevant security events invalidate sessions server-side.
Google and Midtrans
Choosing Google OAuth or opening Midtrans checkout may let their domains set cookies under their own policies. AI Blueprint cannot read cookies available only on a third-party domain.
Analytics and marketing
Analytics and Marketing are off and those optional scripts are not loaded. Because no optional processing is active, we do not show a deceptive Accept All button. Essential cookies operate independently so sign-in and security work.
Changing or withdrawing choices
Open Cookie Settings in the footer at any time. Saving records the version and time on this device. You may also clear browser storage. Blocking essential cookies can break login, Google OAuth, request security, or checkout.
Changes and contact
If new analytics, marketing, or storage is added, the policy and dialog will be updated before activation and consent obtained where required. Requests can be submitted without signing in through hello@aiblueprint.web.id or the Contact page. Do not send passwords, API keys, OTPs, or full payment details.