Cookie & Session Policy

No advertising cookies or retargeting pixels. Google Analytics 4 is loaded only if you accept analytics cookies.

This Cookie & Session Policy explains how AlefOS, operated by MyBot Ltd — Ashkelon, Israel — registration number 516373891 — support@alefos.ai, uses cookies, localStorage, sessionStorage, analytics cookies, and related browser technologies.

AlefOS does not use advertising tracking cookies or retargeting cookies. AlefOS may use Google Analytics 4 only after you accept analytics cookies.

Your access token, auth verification flag, language preference, last visited route, notification settings, and a few UI state flags. Nothing leaves your browser unless it needs to.

AlefOS stores the following data in the browser's localStorage:

— alefos_auth: access token and auth verification flag. The refresh token is not persisted in this localStorage entry; the current client manages refresh through the HttpOnly alefos_refresh cookie. Used to maintain the authenticated session (Zustand persist). Retained until logout or token expiry.
— alefos-language: language preference code (e.g. 'en'). Permanent until changed by the user.
— alefos_last_route: last visited route for post-login redirect. Persists until replaced by the next visit.
— alefos_settings_view: active view in the settings screen. Permanent.
— alefos_context: active tenant context for multi-tenant navigation.
— alefos_deletion_status_cache_v1: cache of account deletion status to avoid repeated API calls. Until cache expiry.
— alefos.hasSignedInBefore and HAS_SIGNED_IN_BEFORE_KEY: boolean flag indicating prior sign-in. Permanent.
— alefos.analyticsConsent: your analytics cookie choice (accepted or rejected), with the date of the choice and the version of this policy. Valid for a maximum of 13 months, after which you are asked again.
— notifCalls, notifMessages, notifMissions: notification UI filter preferences. Permanent.
— profileVisibility, msgPermission, userStatus: user profile settings. Permanent.
— transferNumber: call transfer configuration. Permanent.
— accessibility-menu-dismissed, alefos-accessibility: accessibility preferences. Permanent.

Browser storage also supports the public site’s theme, language and accessibility choices. Persistence is limited to the browser or origin concerned, and “until cleared” is not a server-wide retention policy. An interface preference does not establish that the same choice is applied to every company domain or device.

Temporary data for your current browser session — gone the moment you close the tab.

AlefOS stores the following data in the browser's sessionStorage, which is cleared when the browser tab or window is closed:

— onboardingToken: temporary JWT issued during account registration. Valid for 3600 seconds.
— alefos_return_path: URL to redirect to after login.
— alefos_checkout_order_id: active order identifier for payment resumption.
— alefos_checkout_idempotency_key: idempotency key for payment security.
— OAuth flow state keys (OAUTH_CALLBACK_FROM, OAUTH_APP_LOGIN_ONBOARDING_FLAG, and related): used to secure the OAuth authorization code flow between AlefOS and external OAuth providers.

These storage lifetimes describe browser or token behavior, not the retention of the corresponding account, payment record or server logs. Closing a tab does not cancel a payment or erase the underlying company record.

Strictly necessary cookies support authentication and UI preferences. Analytics cookies are optional and require consent.

AlefOS uses HTTP cookies in a limited capacity. The cookies set are:

— sidebar_state — Provider: AlefOS — Purpose: remembers the open/closed state of the navigation sidebar (UI preference only) — Duration: 7 days.
— Server session cookies (HttpOnly) — Provider: AlefOS — Purpose: the AlefOS API uses credentials: 'include' on certain endpoints (e.g. session restoration), which may result in HttpOnly session cookies being set by the backend server; these are necessary for secure session management and cannot be read by client-side JavaScript — Duration: session or token lifetime.
— _ga — Provider: Google LLC — Purpose: Google Analytics 4 audience measurement (distinguishes visitors) — Duration: up to 2 years — Set only after you accept analytics cookies.
— _ga_<container-id> — Provider: Google LLC — Purpose: Google Analytics 4 session state — Duration: up to 2 years — Set only after you accept analytics cookies.

If you are located in the European Union, strictly necessary cookies do not require your consent under the ePrivacy Directive. Analytics cookies are optional and are not loaded before your consent.

Firebase stores your authentication state in localStorage using its own SDK. It's authentication-only — no tracking.

Firebase Auth, provided by Google LLC, manages its own session tokens using the browserLocalPersistence mechanism, which stores authentication state in localStorage. These tokens are managed by the Firebase SDK and are necessary for authentication. They are not used for advertising or tracking purposes.

When you sign in with Google, Firebase handles the token exchange. AlefOS doesn't create any Google advertising or tracking cookies as part of that flow.

When you sign in using Google OAuth via Firebase, a Firebase ID token is generated and sent to the AlefOS backend to create an AlefOS JWT. AlefOS does not create third-party Google tracking or advertising cookies as part of this flow.

Using Google sign-in also involves the authentication provider’s own processing and information. The absence of an advertising cookie created by AlefOS during sign-in does not mean that the provider processes no data or stores nothing.

GA4 is used only after consent and only for audience measurement.

AlefOS uses Google Analytics 4 only after you choose “Accept” in the analytics cookie consent modal. GA4 helps us measure page views, navigation and product events such as login clicks, documentation clicks, support interactions and successful connector setup.

AlefOS does not intentionally send email addresses, phone numbers, names, message content, support text, authentication tokens or other personal content to GA4. Analytics events are restricted to an allowlist of generic, non-personal parameters before being sent.

Google Analytics is provided by Google LLC, located in the United States. When you accept analytics cookies, data associated with GA4 (such as truncated technical identifiers and usage events) may be transferred to and processed in the United States. This transfer relies on Google LLC's certification under the EU-U.S. Data Privacy Framework and, where applicable, on the European Commission's Standard Contractual Clauses.

Your consent choice is recorded with the date of the choice and the version of this policy, and remains valid for a maximum of 13 months. After that period, or if this policy changes materially, you will be asked again.

AlefOS does not use Facebook Pixel, LinkedIn Insight Tag, advertising retargeting pixels, third-party data broker cookies or advertising tracking cookies.

You can accept or refuse analytics cookies, and you can change your choice later.

You can manage analytics cookies from the cookie consent modal, from the “Manage cookies” link available in the page footer, or from this Cookie & Session Policy by using the “Manage cookies” control. Withdrawing your consent is as easy as giving it: using any of these controls clears your previous choice and shows the consent modal again.

You can also manage or delete browser storage data at any time through your browser settings:

— To clear localStorage and sessionStorage: open your browser's developer tools or settings, navigate to Application > Storage, and clear site data for alefos.ai.
— To block or delete cookies: use your browser's privacy settings. Note that blocking strictly necessary session cookies will prevent authentication from functioning.

For questions about this policy, contact us at support@alefos.ai.

Analytics choice, browser permission for notifications and AlefOS notification settings are different controls. A choice recorded on alefos.ai does not automatically apply to an independently deployed Customer domain. Removing browser storage may sign you out or reset preferences; it does not delete the company’s server-side records.