Purpose and scope
This policy covers cookies and similar browser technologies on prompthalo.ai and the PromptHalo platform. The Privacy Notice covers personal information more broadly, including data processed by the AI services.
What cookies are
Cookies are small files stored in your browser. Similar technologies, including local storage and session storage, can also hold information on your device. This policy treats them the same way.
Approach
Cookie use is limited to what the service needs to operate and stay secure. Optional cookies would appear in this policy before they were set, together with consent or choice controls where the law requires them.
Cookies set here
All cookies set by prompthalo.ai are first-party and strictly necessary. The public marketing pages set none until sign-in.
| Name | Purpose | Expires |
|---|---|---|
ph_session | Holds the authenticated session across pages. Encrypted, and marked HttpOnly, Secure and SameSite=Lax. | Sign-out, or 12 hours |
ph_csrf | Carries a per-session token so forged cross-site requests are rejected. | End of session |
AWSALB, AWSALBCORS | Set by the AWS load balancer to keep requests on the server handling the session. | 7 days |
Service providers
The site embeds no third-party trackers. One third party appears in the sign-in flow: Google Workspace, the identity provider. Sign-in hands you to Google, which sets its own cookies on its own domains. Those fall under Google’s privacy and cookie policies rather than this one, and are neither set nor read here. Only the assertion confirming a successful sign-in comes back.
Advertising and tracking
None of the following are in use:
- Analytics cookies, including Google Analytics or any equivalent
- Advertising, retargeting or conversion pixels
- Cross-site or cross-context behavioral tracking of any kind
- Session replay or heatmap tools
- Social media embeds that set cookies
- Fingerprinting, or any technique that identifies a device without cookies
Cookie data is neither sold nor shared for cross-context behavioral advertising, as California law defines those terms. None exists to sell.
Your choices
Every major browser lets you view, block and delete cookies through its settings, and offers a private mode that discards them when the window closes. Because only strictly necessary cookies are set, blocking them prevents sign-in and the platform will not work. Public pages remain readable.
Global Privacy Control and comparable browser-level opt-out signals are honored. With no tracking in use, such a signal confirms the position rather than changing it.
Policy updates
Adding, removing or changing a cookie updates this policy and the table above before the change reaches production. Anything beyond strictly necessary also means introducing consent controls, and account administrators are told before that happens. This policy is reviewed annually, and together with the Privacy Notice so the two cannot drift apart.
Related information and contact
The Privacy Notice and the Security Overview sit alongside this policy in the Trust Center. Cookie questions go to security@prompthalo.ai.