Cookie Policy
Operated by PUVI Labs Private Limited
Last Updated: June 17, 2026
Effective Date: June 17, 2026
1. What cookies are
Cookies are small text files stored on your device when you visit a website. They help websites remember your session, preferences, and security settings. PUVINoise also uses browser storage (localStorage and sessionStorage) for similar purposes where cookies are not used. This Cookie Policy describes both.
2. Cookies and storage used by PUVINoise
The table below reflects technologies identified in the current application codebase (June 2026 audit). We group them by purpose.
| Name / key | Type | Purpose | Duration |
|---|---|---|---|
| refresh_token | HttpOnly cookie | Secure session refresh for the PUVINoise API | Per refresh-token TTL (see sign-in session) |
| auth_token, auth_user, auth_tenant, auth_effective_permissions, auth_token_issued_at, auth_last_reauth | localStorage | Authenticated SPA session and tenant context | Until sign-out or token expiry |
| auth_refresh_token | localStorage / sessionStorage | Backup refresh token when cookie path is unavailable (e.g. cross-origin dev) | Until sign-out |
| puvinoise_theme | localStorage | Application theme (e.g. enterprise / system) | Persistent until cleared |
| puvinoise-theme | localStorage (next-themes) | Sign-in and onboarding light/dark preference | Persistent until cleared |
| onboardingData | localStorage | Draft onboarding progress on your device | Until onboarding completes or cleared |
| auth_just_logged_in, puvinoise_chunk_reload | sessionStorage | Post-login bootstrap and one-time chunk reload recovery | Browser session |
Feature-specific localStorage keys (e.g. UI dismissals, operator debug probes) may be written on individual pages. They are not used for cross-site tracking.
3. Authentication and security
Essential. PUVINoise cannot operate securely without session mechanisms. The HttpOnly refresh_token cookie is set by our API on sign-in (path=/api/auth, SameSite=Lax, Secure in production). Access tokens and user context are held in browser storage for the single-page application. Clearing cookies or site data will sign you out.
4. Preference and session storage
- Theme:
puvinoise_themeandpuvinoise-themeremember your visual preference across visits. - Onboarding:
onboardingDatapreserves in-progress setup on your device. - Global filters: Agent and time-range filters are primarily stored in the URL query string, not cookies.
5. Third-party services
The following third-party technologies are loaded by the application today:
| Service | Provider | Purpose | Cookies |
|---|---|---|---|
| Vercel Web Analytics | Vercel Inc. | Aggregate page-view and Web Vitals metrics for the deployed app (@vercel/analytics in root layout) | Privacy-oriented analytics; may use first-party identifiers on the app domain. Does not use Google Analytics. |
| Google Sign-In | Google LLC | Optional OAuth on sign-in/sign-up (@react-oauth/google) when NEXT_PUBLIC_GOOGLE_CLIENT_ID is configured | Google may set cookies on accounts.google.com and load Google scripts when you choose "Continue with Google" |
Not loaded in the client application today: Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Mixpanel, Amplitude, Segment, PostHog, Microsoft Clarity, or Stripe.js checkout embeds. Billing is handled server-side via Stripe webhooks; the in-app billing UI does not load Stripe cookie-setting scripts.
First-party product analytics: PUVINoise sends usage events (e.g. feature interactions, runtime activation telemetry) to our own API (/api/intelligence/events) using your bearer token. These requests do not rely on third-party advertising cookies.
6. Browser controls
You can manage cookies and site data through your browser settings:
- Block or delete cookies for
app.puvilabs.com - Clear localStorage and sessionStorage for the site (this signs you out)
- Use private/incognito mode for a temporary session
- Disable third-party cookies to limit Google OAuth auxiliary cookies (may affect federated sign-in)
Blocking essential session cookies or clearing storage will prevent you from staying signed in.
7. Relationship to the Privacy Policy
This Cookie Policy supplements our Privacy Policy, which describes how PUVI Labs processes personal data, your rights, international transfers, and retention. Cookies and browser storage described here are part of that processing for authentication, security, preferences, and aggregated analytics.
8. Changes
We may update this Cookie Policy when we add or remove tracking technologies. Material changes will be noted by updating the "Last Updated" date and, where appropriate, in-app notice.
9. Contact
PUVI Labs Private Limited
Privacy: privacy@puvilabs.com
Legal: legal@puvilabs.com
https://puvilabs.com · https://app.puvilabs.com