Cookie policy

Cookies and similar storage

Cookies are small values sent with browser requests. Local storage stays in a browser for a website origin, while session storage normally lasts for a tab session. These technologies have different purposes and are not all advertising trackers. This policy covers the Elyxir and Alvin websites that link to it; signed-in products may need additional service-specific storage.

Essential and preference storage

The marketing sites use the following storage for functionality and choices. You can clear it in your browser, although doing so can reset preferences or sign you out.

• elyxir_privacy_v1 — local storage containing your optional-analytics choice, policy version, and choice timestamp. Read as valid for up to 365 days, then requested again. It does not contain your name or email. If storage is unavailable, the current page keeps your choice in memory.
• __ph_opt_in_out_* — the analytics SDK may store a corresponding consent flag after it has been used. This records a preference, not a browsing history; it remains until changed or cleared. The website still requires its own valid elyxir_privacy_v1 choice, so an SDK flag alone cannot enable analytics.
• theme — local storage used to remember your chosen display theme. It remains until you change it or clear site data; the site does not assign it an automatic one-year expiry.
• elyxir-hero-arrival-v2 — session storage recording whether the opening animation has played in this tab. It is not a cross-site identifier.
• elyxir_loggedin — a sign-in status hint used to render account navigation when present. It does not itself authorize access to an account.
• Authentication services may set authjs.session-token or __Secure-authjs.session-token, environment-specific variants, and short-lived security or login-flow values. The configured session lifetime is up to 30 days with renewal behavior; actual expiry is available in the cookie’s browser attributes. Authentication storage is required only for the features that use it.
• Hosting, anti-abuse, or payment services can process security-related browser information in their own flows. Cloudflare Turnstile is used on forms when configured. Stripe’s storage applies when you enter its payment flow.

Optional website analytics

PostHog page-visit analytics loads only after you select Allow analytics and only where the production analytics service is configured. Rejecting optional analytics does not prevent you from browsing or contacting us. There is no session replay on these marketing websites, and form values are not sent by this analytics integration.

The integration uses memory-based analytics persistence, so its random identifier is not configured as a persistent analytics cookie. It sends a page path without query parameters or fragments and excludes referrers and account identification from page events. A provider still receives technical connection information needed to receive a request; optional analytics is not the same as anonymous network access.

The old cookie_consent value is no longer treated as permission, because that banner did not control analytics. A new explicit choice is required. These settings do not apply automatically to a separate signed-in application, another domain, or another device.

Changing your choice and privacy signals

Open Cookie settings from the footer or this page to allow analytics or reject it. Both choices are available together. Withdrawal stops further optional website events; it does not erase events already sent. Use Your privacy choices to request deletion or other account-wide privacy rights.

When your browser exposes Global Privacy Control, or sends Sec-GPC: 1, the website blocks optional analytics. We also block it when Do Not Track is enabled. A detected privacy signal takes priority over a saved Allow analytics choice. You can still browse and use essential functionality.

Choices are stored separately on each website origin. Clearing browser storage or changing browsers may require another choice; optional analytics remains off until permission is available. Browser controls can also block or delete storage directly.

Third-party services and links

Following a link to another website, signing in, making a payment, or authorizing a connected service may invoke that service’s cookies and privacy notice. Embedded security tools can be needed to protect a form. Optional website analytics consent does not authorize advertising, content sharing with an AI provider, or third-party actions on your behalf.

Contact [email protected] if you have questions about a particular cookie or browser request. Include its name and the page URL, but do not send its full value if it could contain a session token or other secret.