Cookie & Local-Storage Policy
Last updated: June 30, 2026
Scope
This policy explains how Genlobe's website and web applications use cookies and equivalent browser storage technologies (localStorage and sessionStorage). Under GDPR and the ePrivacy rules, these technologies are treated the same way as cookies: what matters is the storing of, or access to, information on your device — not the specific technical mechanism.
It covers the public Genlobe landing site and the Tenant Dashboard at genlobe.ai/dashboard. It does not cover the applications that customers build on top of Genlobe — each customer is responsible for the cookie policy of its own app. This policy is complementary to our Privacy Policy and Terms of Service; where the treatment of personal data conflicts, the Privacy Policy prevails.
Summary — our stance
- Today we use no analytics, advertising, cross-site tracking, or fingerprinting cookies. There is no Google Analytics, Google Tag Manager, Meta Pixel, Segment, Mixpanel, PostHog, Hotjar, or any advertising network.
- All client-side storage we use today is either strictly necessary (authentication, session security, routing) or first-party functional (interface preferences such as your theme or sidebar state). The full inventory is below.
- Because we use only strictly-necessary and first-party functional storage, we do not show a cookie banner today. None is required.
- No active error monitoring or analytics that collects user data runs today. Before we add any non-essential technology, we will deploy a consent mechanism (see Future changes).
- We do not sell or share personal information and do not run profiling or targeted advertising.
What cookies and browser storage are
- Cookie — a small text file a site stores in your browser and sends back on later requests. It can be a session cookie (deleted when the browser closes) or persistent (expires on a set date), and first-party (set by
genlobe.ai) or third-party (set by another domain). - localStorage — a persistent key-value store, readable only by scripts from the same origin. It is not sent to the server automatically on every request; the client reads it and attaches it when needed.
- sessionStorage — the same as localStorage, but cleared when the tab or window closes.
Genlobe uses primarily localStorage, plus one routing cookie and, where the browser needs it, first-party sessionStorage. Under GDPR and ePrivacy, all of these receive the same necessity and consent analysis.
Inventory
The list below is compiled directly from the Genlobe code and is exhaustive as to what the platform itself writes. It does not include storage a browser may set on its own, nor storage set by applications that customers build on Genlobe. If we add any new item, this inventory and the "last updated" date are revised in the same change.
One first-party cookie: has_active_plan (SameSite=Lax, not httpOnly, roughly 7 days). It records whether the signed-in member has an active plan, so post-login dashboard routing can decide access without re-querying the backend on every navigation. It is a derived boolean value, not a tracking identifier, and it is rewritten on session validation and cleared on logout. This cookie is strictly necessary. No third-party cookies are set by the Genlobe platform.
Strictly-necessary localStorage (authentication and session):
| Key | Purpose | Duration |
|---|---|---|
| Genlobe_auth_tokens | JWT access and refresh tokens for an end-user or Organization Owner session. Keep you signed in and allow automatic token refresh without re-login. Contain authentication data. | Until logout or refresh-token expiry (removed on logout) |
| tenant_auth_tokens | JWT access and refresh tokens for a TenantMember in the Tenant Dashboard. Same purpose as above, for the Tenant session. | Until logout or refresh-token expiry |
A note on session tokens, stated plainly: these authentication tokens live in localStorage — they are not stored in httpOnly cookies. This reflects the current implementation.
First-party functional storage (interface preferences): these items only remember your own preferences. They do not track or profile you, and they are not shared with any third party.
| Key | Purpose | Duration |
|---|---|---|
| theme | Remembers your light/dark theme choice. | Until you change it or clear your browser |
| sidebar-groups-state | Remembers which sidebar navigation groups you have expanded or collapsed. | Persistent |
| custom-entities-view-mode | Remembers your preferred view (e.g. list or diagram) in the Custom Entities module. | Persistent |
| custom-entities-node-positions | Remembers the position of nodes in the Custom Entities diagram view. | Persistent |
| agent-changes:dismissed:<organizationId> | Remembers that you dismissed the agent-changes notice for a specific Organization, so it is not shown again. | Persistent |
| tenant-switch:pending | Transient state used during a context switch between Tenants (transition overlay). | Transient / session |
Legal basis (GDPR / UK GDPR)
- Strictly-necessary storage (the routing cookie and authentication tokens) is exempt from ePrivacy's prior-consent requirement because it is essential to deliver the service you asked for — signing in, session security, and routing. The legal basis for any associated personal data is Article 6(1)(b) (performance of the contract) and 6(1)(f) (legitimate interest in platform security).
- First-party functional storage records your own interface preferences and adds no banner friction. It is not used to track or profile you.
- Any future non-essential technology (analytics, third-party tags) would rely on consent (Article 6(1)(a)) — prior, freely given, specific, informed, and as easy to withdraw as to give. Nothing non-essential is loaded before consent.
We do not carry out automated decision-making with legal effects (Article 22 GDPR) based on cookies or browser storage.
Your choices
Browser controls. You can view, block, or delete cookies and storage from your browser settings. Note that clearing or blocking the strictly-necessary storage will sign you out and may prevent login, because that is where the session tokens live. Clearing the functional storage only resets your preferences (theme, navigation state).
California (CCPA / CPRA). The information collected via browser storage today is limited to account/session identifiers and interface preferences (see the Inventory). Genlobe does not "sell" or "share" personal information (including for cross-context behavioral advertising) through cookies or browser storage. Because there is no sale or sharing to opt out of, we do not offer a "Do Not Sell or Share My Personal Information" link. If any future practice ever qualified as a sale or sharing, we would publish the required opt-out mechanism (including recognition of Global Privacy Control signals) and update this policy before starting that practice.
Future changes
No cookie banner is needed today because we use only strictly-necessary and first-party functional storage. Before adding any non-essential technology — product or web analytics, session replay, error monitoring that collects user data, A/B testing, heatmaps, or any third-party tag or cookie — we will:
- deploy a consent management platform (CMP) with prior, granular, per-category opt-in that is as easy to withdraw as to give, respecting GPC / Do-Not-Track signals where applicable;
- update this policy (inventory, legal basis, and any sub-processors) and revise the "last updated" date; and
- where applicable, record the consent (what, when, and which version) in a versioned way.
Contact
Genlobe is a product of Kleio Technology, based in West Palm Beach, Florida, USA. Questions about this policy or about cookies and browser storage can be sent to privacy@genlobe.ai.