Cookie Policy
Last updated: November 3, 2026
1. Introduction
This Cookie Policy explains how Kraitos, Inc. ("Kraitos", "we", "us") uses cookies and similar technologies (such as browser local storage) when you use the Kraitos AIDR dashboard at aidr.kraitos.io (the "Service"). It should be read together with our Privacy Policy.
Cookies are small text files placed on your device by a website. Similar technologies, such as local storage, store data in your browser. We use these technologies primarily to keep you securely signed in and to protect the Service against certain attacks.
Kraitos AIDR is a session-cookie-first application. The cookies the dashboard sets are limited to those needed to operate and secure it, and the dashboard does not use advertising cookies. Our public marketing website at www.kraitos.io additionally uses Google Analytics to measure traffic and, only if you opt in, a Reddit advertising pixel to measure the performance of our ads on Reddit, as described in Section 4.
2. Cookies and Similar Technologies We Use
The Service relies on the following, all of which are strictly necessary for authentication and security:
| Name | Type | Purpose | Duration |
|---|---|---|---|
kraitos_access |
HTTP cookie (httpOnly, Secure) | Holds the short-lived JWT access token that authenticates your session. httpOnly means it cannot be read by JavaScript, reducing the risk of theft via cross-site scripting. |
Session / short-lived |
kraitos_refresh |
HTTP cookie (httpOnly, Secure) | Holds the longer-lived JWT refresh token used to renew your access token without re-entering credentials. | Persistent until expiry or sign-out |
csrftoken |
HTTP cookie | Protects against cross-site request forgery (CSRF) by validating that requests originate from the genuine dashboard. | Session / configurable |
We may also use a small amount of browser local storage or session storage to retain non-sensitive user-interface preferences (for example, layout or theme settings). These do not track you and are not shared with third parties.
3. Cookie Categories
Strictly necessary cookies. All cookies listed in Section 2 are strictly necessary: the Service cannot function securely without them because they authenticate your session and protect against CSRF. Because they are essential to a service you have requested, they do not require opt-in consent under most cookie laws — but we describe them here for transparency.
Optional / non-essential cookies. The marketing website has two optional categories, each off until you turn it on: Analytics (Google Analytics, Section 4) and Advertising (the Reddit Pixel, Section 4). Both are set on the marketing website only; the dashboard sets neither.
We ask before we set them. On your first visit to www.kraitos.io a consent dialog appears and must be answered before you can continue. You can choose Accept all, Reject all, or Choose which categories to allow and then Save choices. Google's measurement script runs in the background on every visit, using Google's Consent Mode, but it starts with storage denied: no analytics cookie is set and no identifiable data is sent to Google unless you allow Analytics. The Reddit Pixel is different: its script is not loaded at all unless you allow Advertising. Reject all, pressing Escape on this first-visit notice, or ignoring the notice leaves both categories switched off; if you had previously accepted, withdrawing a category also deletes that category's cookies already stored. We remember your choice in your browser's local storage so we do not have to ask again.
Changing your mind. Select Cookie settings in the site footer to bring the notice back and switch Analytics and Advertising on or off at any time. The reopened dialog has a Close button, and Escape on it simply closes it without changing your choices. Withdrawing consent is as easy as giving it.
Global Privacy Control. If your browser sends the Global Privacy Control (GPC) signal, we treat Advertising as off regardless of any earlier choice, and the Advertising option is shown as off and unavailable.
4. Third-Party Cookies
Google Analytics (marketing website). The public website at www.kraitos.io uses Google Analytics 4 (measurement ID G-M0SFQB4B16) to understand which pages visitors read and which links they follow. It sets the following cookies on that domain:
| Name | Purpose | Duration |
|---|---|---|
_ga |
Distinguishes one visitor from another so repeat visits are not double-counted. | 2 years |
_ga_<container-id> |
Maintains analytics session state for the property. | 2 years |
These cookies are only set after you accept the consent notice described in Section 3. Google Analytics 4 does not store full IP addresses, IP anonymisation is enabled, and we do not use it for advertising, remarketing, or ad personalisation. Google processes this data as described in its own privacy notice. You can opt out across all sites using Google's browser add-on at https://tools.google.com/dlpage/gaoptout, or by blocking cookies as described in Section 5.
The dashboard itself does not load Google Analytics.
Advertising cookies: Reddit Pixel (marketing website). If you allow the Advertising category, the website loads the Reddit Pixel from Reddit, Inc. so we can measure how our ads on Reddit perform and which ad clicks lead to sign-ups. It is loaded only after you opt in and never when GPC is on. With it, we send Reddit events such as pages visited and clicks on our sign-up link, the public descriptive information on the page visited (its title, description and the summary tags we publish for search engines and link previews), together with device and browser identifiers and your IP address, which Reddit receives with any request. We do not intentionally send names, email addresses, or other directly identifying information. We configure the Pixel's automatic advanced matching to be off in our Reddit account, and we do not run the Pixel on pages with forms (contact, demo and investor request pages): if the Pixel is already running when you open one of these pages, the page is loaded fresh without it [confirm with counsel: wording, because the advanced matching setting is controlled in Reddit's account configuration rather than guaranteed by our code]. It sets the following:
| Name | Purpose | Duration |
|---|---|---|
_rdt_uuid |
First-party identifier that lets Reddit attribute a conversion on our site to an ad on Reddit. | 90 days [confirm with counsel: duration as documented by Reddit; cookie names and retention may change] |
_rdt_cfg (session storage, not a cookie) |
Caches the Pixel's configuration for the browser session. Contains no personal identifier. | Browser session |
_rdt_* (other) |
Any other first-party cookie whose name starts with _rdt, set by the Pixel for the same purpose (for example _rdt_cid, which holds the ad click identifier). |
As documented by Reddit [confirm with counsel] |
Reddit may also read or set its own cookies on reddit.com, for example if you are signed in to Reddit; those are governed by Reddit's cookie notice. Reddit acts under its own terms for pixel data; see Reddit's privacy policy at https://www.reddit.com/policies/privacy-policy. You can withdraw consent at any time through Cookie settings in the site footer (this also deletes the _rdt cookies), or by enabling Global Privacy Control in your browser.
Cloudflare Web Analytics (marketing website). Our edge provider Cloudflare also measures aggregate traffic to www.kraitos.io. This measurement is cookieless — it sets no cookies and does not track you across sites or visits, so it runs whether or not you accept analytics cookies.
The core dashboard is designed to operate without third-party tracking cookies. Some infrastructure providers we use (for example, our CDN/edge provider Cloudflare) may set limited cookies necessary for security, load balancing, or bot mitigation. Payment pages hosted by Stripe may set their own cookies subject to Stripe's cookie and privacy notices. We do not control cookies set directly by these third parties on their own domains; please refer to their policies for details.
5. How to Control Cookies
Because the dashboard's cookies are strictly necessary, disabling them will prevent you from signing in or using the Service. The optional Analytics and Advertising cookies on the marketing website are controlled through Cookie settings in the site footer. You can also control cookies through your browser:
- Browser settings. Most browsers let you view, block, or delete cookies and clear local storage. See your browser's help pages for instructions. Blocking the cookies in Section 2 will break authentication.
- Signing out. Signing out of the dashboard clears or invalidates your session cookies.
- Global Privacy Control. We honour the GPC signal as an opt-out of the Advertising category (Reddit Pixel).
- Do Not Track. "Do Not Track" browser signals do not change our behavior; use Cookie settings or GPC instead.
If we add other optional cookies in the future, you will be able to manage your preferences through the consent mechanism provided at that time.
6. Changes to This Policy
We may update this Cookie Policy to reflect changes to the Service or to legal requirements. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Material changes affecting non-essential cookies will be handled consistently with applicable consent requirements.
7. Contact
If you have questions about this Cookie Policy or our use of cookies, contact us at:
- Email: [email protected]
- Privacy contact: [email protected]
- Entity: Kraitos, Inc.