Cookie policy

1.The short version

One cookie is needed for the product to work. The rest are analytics, they belong to Google and Microsoft, and they load before you have been asked.

That last part is a gap rather than a policy, and section 4 says so plainly instead of burying it.

2.What is set

Cookie	Set by	What it does	How long	Kind
`aeoly_session`	Aeoly	Keeps you signed in. Holds a random token and nothing about you.	Until it expires or you sign out	Essential
`_GRECAPTCHA`	Google reCAPTCHA	Set on the sign-in and sign-up pages only, to tell a person from a script before an emailed sign-in link is sent.	Up to 6 months	Essential
`_ga, _ga_*`	Google Analytics	Tells repeat visits apart so we can count visitors rather than page loads.	Up to 2 years	Analytics
`_clck, _clsk`	Microsoft Clarity	Ties a session together so a replay is one visit rather than a pile of unrelated events.	_clck up to 1 year, _clsk 1 day	Analytics
`MUID, CLID, ANONCHK, SM`	Microsoft	Set by Clarity's own infrastructure to identify a browser across Microsoft properties.	Up to 13 months	Analytics

The Microsoft cookies in the last row are not ones we chose individually. They come with Clarity, and they are listed because they end up in your browser either way.

3.What Clarity records

Google Analytics counts visits. Microsoft Clarity does more than that: it records the session. Scrolling, clicks, mouse movement and the shape of the page are captured so we can play back how a page was used and see where people get stuck.

Clarity masks text input by default, so what you type into a form should not appear in a recording. We use it on the marketing pages to work out which explanations are not landing. It is still a recording of your visit, and you are entitled to know that without digging.

4.The consent gap, stated plainly

Analytics and Clarity currently load on every production page view. There is no banner, and no way to decline them on this site before they run.

Under UK PECR and the EU ePrivacy rules that is not sufficient. Those rules want consent before a non-essential cookie is set, not a notice afterwards, and a policy page like this one does not count as consent.

We would rather write that down than describe a consent flow that does not exist. Fixing it properly means a gate that holds both scripts until someone agrees, which is a change to the product and not to this page. Until then, section 5 is the route that actually works, and it works whether or not we build anything.

5.How to refuse them

These all work today and do not depend on us:

Block them in your browser. Every major browser can refuse third-party cookies or block them per site. The product keeps working, because the only cookie it needs is its own.
Opt out of Clarity. Microsoft honours the Microsoft privacy choices settings across its properties.
Opt out of Google Analytics. Google publishes a browser add-on that stops it reporting.
Use a blocker. Ordinary content blockers stop both, and we are not going to work around one.

Blocking the session cookie will sign you out and keep you out, because that cookie is how the product knows who you are. Nothing else here is needed for anything to work.

6.Elsewhere

The free tools do not set cookies of their own, and the ones that run in your browser send nothing anywhere. What each of them does is described on its own page under free tools.

Which data goes to which company, and why, is in the privacy policy. Questions go to support@aeoly.ai.