Cookies and storage
Last updated: 29 October 2026
This page lists everything kju.ai and the kju app store on your device: cookies, browser storage and app storage. Before you make a choice, kju.ai stores nothing optional on your device: necessary and functional items are written only when a feature you use needs them, such as signing in or a theme you pick. Optional analytics and advertising storage is written only after you allow it, and removed when you refuse or withdraw. Each choice you make is also recorded on our servers, with no browsing data, so we can show that it was given. Records are kept for 24 months.
How we use personal data is in our Privacy Policy.
On kju.ai
Strictly necessary
Needed to provide the service you asked for (sign-in, security, recording your cookie choice). Exempt from consent under Art. 5(3) ePrivacy; disclosed here.
| Name | Purpose | Duration | Party |
|---|---|---|---|
wos-sessionCookie, set by WorkOS AuthKit (authkit-nextjs) | Keeps you signed in: the sealed WorkOS session (access and refresh token). | 400 days, refreshed while you use kju | First party |
wos-auth-verifier-<hash>Cookie, set by WorkOS AuthKit (authkit-nextjs) | Protects a single sign-on attempt (PKCE verifier). | 10 minutes | First party |
kju-auth-provider-state-<id>Cookie | Protects a Google, GitHub or SSO sign-in attempt against forgery (sealed state and verifier). | 10 minutes | First party |
kju-auth-organization-selectionCookie | Holds the organization choice step during sign-in. | 10 minutes | First party |
kju-auth-email-verificationCookie | Holds the email-code verification step during sign-in. | 15 minutes | First party |
kju-auth-retryCookie | Stops two tabs refreshing the same sign-in at once from signing you out. | 15 seconds | First party |
kju-preview-login-skip-onboardingCookie | A demo or preview link signs you straight into the app without onboarding. | 10 minutes | First party |
kju-brand-hold-continuesCookie | Stops the loading animation replaying after a demo-link sign-in. | 20 seconds | First party |
kju-content-previewCookie | Kju editors only: shows draft website copy from a content preview link. | Browser session | First party |
__prerender_bypassCookie, set by Next.js draft mode | Kju editors only: serves the draft instead of the published page. | Browser session | First party |
kju_analytics_consentlocalStorage | Remembers your analytics choice so the banner does not ask again, with the id of the consent receipt we recorded for it, so a choice made while signed out can be matched to our record. | Until you change it or clear site data | First party |
kju_marketing_consentlocalStorage | Remembers your advertising choice. | Until you change it or clear site data | First party |
__ph_opt_in_out_<project>localStorage, set by PostHog (posthog-js) | PostHog's own record of your choice: 1 allowed, 0 refused. Written only once you choose. | Until you change it or clear site data | First party |
kju_ads_withdrawal_v1localStorage | Retries your ad-measurement withdrawal until our server confirms it. | Until the withdrawal is confirmed | First party |
__stripe_midCookie, set by Stripe.js, loaded by the RevenueCat web checkout | Fraud prevention for a payment you start. Set on kju.ai by Stripe.js once the subscription checkout opens. | 1 year | First party |
__stripe_sidCookie, set by Stripe.js, loaded by the RevenueCat web checkout | Fraud prevention for the checkout session you are in. Set on kju.ai by Stripe.js once the subscription checkout opens. | 30 minutes | First party |
Functional, at your request
Written only when you use the feature it serves (a setting, a draft, a notification). Exempt as necessary for the service you requested.
| Name | Purpose | Duration | Party |
|---|---|---|---|
themelocalStorage, set by next-themes | Your light, dark or system theme, once you pick one. | Until you change it or clear site data | First party |
kju-demo-bookedlocalStorage | Hides the book-a-demo button after you have booked one. | Until you clear site data | First party |
kju.onboarding.anonymousDraft.v1localStorage | The answers you type in the onboarding chat before you sign in, so they are not lost. | Until you finish sign-up or clear site data | First party |
kju.onboarding.pendingAdoption.v1:<owner>localStorage | Moves those onboarding answers into your new account exactly once. | Until the answers are saved to your account | First party |
kju:onboarding-conversation-draft:<user>localStorage | Lets you resume the onboarding conversation where you left it. | Until onboarding is complete | First party |
kju-employee-intake-<user>localStorage | Lets an organization member resume their intake answers. | Until the intake is submitted | First party |
kju.learner-sidebar-modelocalStorage | Remembers whether you collapsed the app sidebar. | Until you change it or clear site data | First party |
kju:desktop-app-nudge:<user>localStorage | Limits how often we suggest the phone app on desktop. | Until you clear site data | First party |
kju:recap-app-handoff:<user>localStorage | Hides the get-the-app prompt for 30 days after you dismiss it. | Until you clear site data (the prompt returns after 30 days) | First party |
kju:web-push-ask:v2:<user>localStorage | Limits how often we ask about browser notifications. | Until you clear site data | First party |
kju:web-push-device-id:v1localStorage | Identifies this browser's notification subscription so we can remove it when you turn notifications off. | Until you clear site data | First party |
kju:web-push-opted-out:v1localStorage | Remembers that you turned browser notifications off. | Until you change it or clear site data | First party |
kju-admin-lifecycle-sim-emaillocalStorage | Kju staff only: remembers the test address in an internal admin tool. | Until cleared | First party |
challenge_pending_seensessionStorage | Stops a 1v1 challenge invite popping up twice in the same tab. | Until the tab closes | First party |
/push-sw.jsService worker | Shows browser notifications you turned on. It stores no data, caches nothing and uses no IndexedDB. | Until you turn notifications off or clear site data | First party |
YouTube player storage (yt-player-*, ytidb and similar on youtube-nocookie.com)Embedded player, set by YouTube (privacy-enhanced embed) | Plays the product demo video. Nothing loads from YouTube until you press play; YouTube then keeps player settings in its own localStorage and IndexedDB. | Set by YouTube | Third party |
Analytics, with consent
Written only after you choose Analytics only or Accept all. Refusing or withdrawing removes it.
| Name | Purpose | Duration | Party |
|---|---|---|---|
ph_<project>_posthogCookie, set by PostHog (posthog-js) | Product analytics identity and session, sent to PostHog EU through our own domain. Also kept in localStorage, with its feature-flag cache as ph_<project>_posthog__flags. | 1 year | First party |
kju_acquisition_v1localStorage | Which campaign, referring site and landing page brought you to kju (UTM parameters). Joined to your account when you sign up. | Until you refuse analytics or clear site data | First party |
ph_<project>_posthog, ph_<project>_window_id, ph_<project>_primary_window_existssessionStorage, set by PostHog (posthog-js) | Tells PostHog sessions in separate tabs apart. Removed when you refuse analytics. | Until the tab closes | First party |
Advertising, with consent
Written only after you choose Accept all. Refusing or withdrawing removes it and reloads the page.
| Name | Purpose | Duration | Party |
|---|---|---|---|
_ga, _ga_*, _gcl_au, _gcl_aw and other Google tag cookiesCookie, set by Google Ads and Google Tag Manager | Measures which Google ads led to a demo request or sign-up. | Set by Google, up to 2 years | Third party |
LinkedIn Insight Tag cookies (li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory)Cookie, set by LinkedIn Insight Tag | Measures which LinkedIn ads led to a demo request or sign-up. | Set by LinkedIn, up to 1 year | Third party |
__oppref, __obrefCookie, set by OpenAI ads pixel | Measures which ChatGPT ads led to a sign-up. | Set by OpenAI | Third party |
kju_acquisition_click_ids_v1localStorage | Ad click identifiers (gclid, li_fat_id) from the link that brought you here. | Until you refuse advertising or clear site data | First party |
kju_ads_clicks_v1localStorage | The last four ad clicks, used to attribute a demo request to an ad. | 90 days of eligibility; removed when you refuse advertising | First party |
kju_ads_receipt_v1localStorage | A random receipt that lets you withdraw ad measurement for your demo request later. | Until you refuse advertising or clear site data | First party |
kju.ai’s own pages use no IndexedDB or Cache Storage. The YouTube player and the Stripe checkout listed above keep their own storage once you play the video or start a purchase.
In the kju app
Strictly necessary
Needed to provide the service you asked for (sign-in, security, recording your cookie choice). Exempt from consent under Art. 5(3) ePrivacy; disclosed here.
| Name | Purpose | Duration | Party |
|---|---|---|---|
workos_token_pair_v2SecureStore | Keeps you signed in (WorkOS access and refresh token). | Until sign-out or uninstall | First party |
workos_pkce_statesSecureStore | Protects a sign-in attempt (PKCE verifier). | Until the sign-in completes | First party |
workos_auth_quarantine_v1SecureStore | Stops a rejected session from signing back in automatically. | Until the next successful sign-in | First party |
kju.analytics-consent.v1SecureStore | Remembers your product analytics choice in Settings (off unless you turn it on). | Until you change it or uninstall | First party |
kju.analytics-revocation-barrier.v1SecureStore | Keeps analytics off if the app closes while you are turning it off. | Until the change completes | First party |
kju.analytics-deletion-barrier.v1SecureStore | Keeps analytics off while your account is being deleted. | Until deletion completes | First party |
kju-guest-stateSecureStore | Guest mode state and a random id that rate-limits the free trial. | Until uninstall | First party |
kju-guest-reminders-migrated-v1SecureStore | Marks that old guest reminders were cancelled once. | Until uninstall | First party |
Functional, at your request
Written only when you use the feature it serves (a setting, a draft, a notification). Exempt as necessary for the service you requested.
| Name | Purpose | Duration | Party |
|---|---|---|---|
kju-guest-first-sessionSecureStore | Your guest trial session, so it can move into your account when you sign up. | Until claimed or uninstall | First party |
kju.launch-motion-install.v2SecureStore | Plays the first-launch animation once per install. | Until uninstall (on iOS the Keychain can keep it after deletion) | First party |
theme-preferenceSecureStore | Your light or dark theme, once you pick one. | Until you change it or uninstall | First party |
store_review_session_count, store_review_last_promptSecureStore | Limits how often the app asks for an App Store or Play review. | Until uninstall | First party |
kju-push-prompt-policySecureStore | Limits how often the app asks about notifications. | Until uninstall | First party |
kju-push-device-id, kju-push-registration-identity-v1, kju-push-token-ever-registered-v1, kju-push-cleanup-journal-v1 (and its -corrupt and dead-letter twins)SecureStore | Registers and later removes this phone's notification token for the right account. | Until you turn notifications off, sign out or uninstall | First party |
kju-recap-celebration-<session>SecureStore | Shows a session's recap celebration once. | Until uninstall | First party |
kju-onboarding-conversation-draft-<user>SecureStore | Lets you resume the onboarding conversation. | Until onboarding is complete | First party |
kju-tester-checkpoint-<user>SecureStore | Remembers which requested tester checkpoint this device has applied. | Until the next tester checkpoint or storage reset | First party |
kju-pending-individual-profile-<user>SecureStore | Holds your profile answers until they are saved. | Until saved | First party |
kju-employee-intake-<user>SecureStore | Lets an organization member resume their intake answers. | Until submitted | First party |
kju-onboarding-anonymous-draft.json, kju-onboarding-pending-adoption-<user>.json, kju-existing-account-notice-<user>.jsonApp file | Onboarding answers typed before sign-in, their move into your account, and a one-time sign-in notice. Too large for SecureStore. | Until used or uninstall | First party |
Streak widget snapshot (App Group container)App group | Lets the home-screen widget show your streak. | Until overwritten or uninstall | First party |
Analytics, with consent
Written only after you choose Analytics only or Accept all. Refusing or withdrawing removes it.
| Name | Purpose | Duration | Party |
|---|---|---|---|
kju.push-permission-settings-analytics.v2, kju.push-permission-settings-analytics-scrub.v1SecureStore | Queues one analytics event about a notification-permission change made in system Settings. Only written while analytics is allowed. | Until the event is sent | First party |
- The app has no AsyncStorage or MMKV. Product analytics (PostHog) keeps its state in memory only and starts off; you can turn it on in Settings.
- RevenueCat and Sentry keep their own caches on the device (purchase status; unsent crash reports). Crash reports carry no personal data beyond a stable account id.