Cookie Policy

This policy explains how SquidHub uses cookies and similar storage technologies on squidhub.ai and in the app. We keep this short on purpose. We use essential storage to keep you signed in, and we use optional analytics storage only after you accept it so we can understand which features get used and make the product better. We do not run advertising cookies, and we do not track you across other websites.

It sits alongside our Privacy Policy and Security documentation, which describe how the rest of your data is handled. For the wider picture, see our Trust Center.

What a cookie is

A cookie is a small text file that a website asks your browser to store. On a later visit the browser sends it back, which lets the site recognise your session or remember a preference. "Similar technologies" - local storage, session storage, and pixels - do related jobs and are covered by this policy too. A cookie can be a first-party cookie (set by squidhub.ai) or a third-party cookie (set by another service we use). Cookies can be session cookies, which disappear when you close the browser, or persistent cookies, which last a set period.

The cookies we use

Essential - keeping you signed in

When you sign in, we set a single first-party session cookie so the app knows it is you on each request. This is strictly necessary: without it you cannot stay logged in, and the product does not work. A few notes on how it is built, because the detail matters:

• The cookie is HttpOnly, so JavaScript cannot read it; Secure, so it travels only over HTTPS; and SameSite=Lax, which blunts cross-site request forgery.
• We store only a SHA-256 hash of the session token in our database, never the raw token. A database leak therefore cannot be replayed as a login.
• The cookie carries no message content, no squid prompts, and no profile data - just an opaque session reference.
• You can list and revoke your sessions, including "log out everywhere," from your account settings. Signing out clears the cookie.

Because this cookie is essential to a service you have asked to use, it does not require separate consent. Blocking it will sign you out and break the app.

Optional analytics - understanding what to improve

If you accept analytics, we use Amplitude Browser SDK with autocapture and Session Replay to see which features are used, where flows break, and whether a change helped. This tells us, for example, that people created a squid but never opened a room - the kind of signal that decides what we build next.

• No message content, ever. Analytics events carry product actions and coarse context, never the text of your conversations, your squids' instructions, your memory, or your files. That content is encrypted at rest and is out of scope for analytics by design - see Security.
• Session Replay is masked. We configure conservative masking so text and form fields are not sent in replay data. We still treat replay as optional analytics and do not start it until you accept analytics storage.
• No ad profiles, no cross-site tracking. We do not build advertising profiles and we do not follow you onto other sites.
• Your choice is stored locally. We store sq_analytics_consent in local storage as granted or denied. If it is absent or denied, Amplitude does not start. You can reopen the choice from Cookie settings in the landing footer.

Anti-abuse

On a few abuse-prone surfaces - chiefly sign-up and contact forms - we may run a privacy-preserving anti-bot challenge (Cloudflare Turnstile). It sets short-lived storage to tell a human from a bot. It carries no account information and is not used for advertising or profiling. This challenge is enabled only when the relevant key is configured.

What we do not use

We want to be explicit, because most cookie banners exist precisely for the things we have chosen not to do:

• No advertising or targeting cookies. We do not serve ads, so we have no ad cookies.
• No cross-site tracking and no data brokers. We do not sell or share your personal information for advertising.
• No social media trackers embedded across the app.

Third-party context

A handful of services we rely on may set their own cookies in the narrow contexts where they appear - for example, signing in with Google sets cookies on Google's domain under Google's policy, Calendly may set storage when you book a demo on Calendly, and Amplitude sets analytics storage only after you accept analytics. The full list of services that process data for SquidHub, and exactly what each sees, is in our Privacy Policy and Security documentation. We do not control the cookies set on a third party's own domain; those are governed by that party's policy.

How to control cookies

You are in charge of cookies in your browser. Every major browser lets you view stored cookies, delete them, and block some or all of them:

• Chrome, Edge, Brave - Settings, then Privacy and security, then Cookies and site data.
• Safari - Settings, then Privacy, then Manage Website Data.
• Firefox - Settings, then Privacy & Security, then Cookies and Site Data.

You can also browse SquidHub in a private or incognito window, which discards cookies when you close it. Bear in mind that blocking our essential session cookie will prevent you from staying signed in. On the landing page, use Cookie settings in the footer to accept or reject optional analytics. A general guide to managing cookies across browsers is available at allaboutcookies.org.

Do Not Track and Global Privacy Control

Some browsers can send a "Do Not Track" (DNT) signal or a Global Privacy Control (GPC) signal. There is no industry-agreed standard for how a site must respond to DNT. GPC is designed for sale/sharing opt-outs; we do not sell personal information or share it for cross-context behavioural advertising. Optional analytics are controlled by the Accept analytics / Reject choice instead. Rejecting analytics prevents Amplitude from starting, and accepting analytics can be changed later from Cookie settings.

Changes to this policy

As the product changes, we may update this policy. When we do, we will revise the "Last updated" date above. Material changes - for instance, introducing a new category of cookie - will be communicated more prominently. Continued use of SquidHub after an update means the current policy applies.

Contact

Questions about cookies or your data can go to privacy@squidhub.ai, or support@squidhub.ai for help with your account.

Frequently asked questions

Does SquidHub use advertising cookies

No. We do not serve ads and we do not run advertising, targeting, or cross-site tracking cookies. We use one essential sign-in cookie and optional Amplitude analytics/session replay only after you accept analytics.

Can I use SquidHub without cookies

Not fully. The essential session cookie is what keeps you signed in, so blocking it will log you out and break core features. You can reject non-essential analytics storage and still use the product.

Do your analytics see my messages

No. Analytics events record product actions, never the content of your conversations, squid instructions, memory, or files. Session Replay is conservatively masked and only starts after analytics consent. Your content is encrypted at rest and is out of scope for analytics by design. See our Security documentation.

How do I delete the cookies SquidHub has set

Use your browser's cookie settings to view and delete cookies for squidhub.ai, or sign out to clear the session cookie. You can also revoke any active session from your account settings.

Does SquidHub honour Do Not Track

There is no agreed standard for Do Not Track. We do not sell personal information or share it for cross-context behavioural advertising, so GPC has no sale/share opt-out to apply. Optional analytics are controlled through the cookie banner and Cookie settings.