Cookie Policy · IdonAI

1. Introduction

This Cookie Policy explains how IdonAI ("IdonAI," "we," "us," or "our") uses cookies and similar technologies when you visit https://idonai.com, use Quark at https://quark.idonai.com, or interact with our APIs, documentation, and related online services (collectively, the "Services").

It should be read together with our Privacy Policy at https://idonai.com/legal/privacy, which describes how we collect, use, and protect personal information more broadly. Capitalized terms used but not defined here have the meanings given in the Privacy Policy or our Terms of Service.

Last updated: July 9, 2026. Effective date: July 9, 2026. This Policy is governed by the laws of New South Wales, Australia, and disputes relating to it are subject to the courts of New South Wales, Australia, except where mandatory consumer or data-protection laws provide otherwise.

2. What are cookies and similar technologies?

Cookies are small text files placed on your device by a website or application. They typically contain a name, a value, and attributes such as expiry, path, domain, and security flags (for example, Secure or HttpOnly). Cookies help sites remember state across requests, keep you signed in, remember preferences, and understand how the product is used.

We also use — or may use — technologies that perform similar functions to cookies. These are covered by this Policy even when they are not technically “cookies” under every legal definition:

Local storage and session storage (browser storage APIs used to keep preferences or short-lived UI state on your device).
Pixels or tags (small images or scripts that may record that a page was loaded or an event occurred).
Software development kits (SDKs) embedded in web or client applications that may set identifiers or collect telemetry.
Server-side session identifiers associated with cookies or tokens used to authenticate API and product requests.
Device or browser signals used for security (for example, to detect abuse, rate-limit traffic, or protect accounts).

Some of these technologies are first-party (set by IdonAI domains). Others may be set by third parties that provide infrastructure, authentication, hosting, or analytics on our behalf. The sections below explain categories, purposes, and how you can control them.

3. Who sets cookies?

Cookies and similar technologies on the Services generally fall into two groups:

First-party: set by IdonAI on domains we control (including idonai.com, quark.idonai.com, and related subdomains). These typically support authentication, security, preferences, and core product operation.
Third-party: set by service providers that help us operate the Services (for example, authentication infrastructure, content delivery, hosting, or analytics). Third-party cookies are subject to those providers’ own policies in addition to ours.

Where we use third-party processors, they act under our instructions and applicable data-processing terms. We do not sell personal information collected via cookies for advertising purposes, and we do not currently run third-party advertising networks on the Services.

If you arrive at IdonAI from an external site, that external site may set its own cookies before you reach us. Those cookies are outside IdonAI’s control and are governed by the external site’s policies.

4. Types of cookies we use

We group cookies and similar technologies by purpose. Not every category is active on every page or for every user. Categories may evolve as we ship product features; material changes will be reflected in this Policy.

Strictly necessary. Required for the Services to function securely and as requested. Examples include session and authentication cookies, load-balancing or routing tokens, CSRF or request-integrity protections (where applicable), fraud and abuse prevention signals, and cookie-consent preference storage itself. These technologies do not require consent under many privacy regimes because they are necessary to provide the service you request, though we still describe them here for transparency.

Functional / preferences. Remember choices you make so the experience is consistent across visits. On the IdonAI website, this includes theme preference (light/dark), which is stored via localStorage under a key such as idon-theme, and may include other UI preferences (for example, recent search history stored locally on your device). These are not used for advertising.

Analytics / performance. Help us understand how the Services are used — for example, which pages are visited, approximate geographic region derived from IP (where processed), device/browser type, referral paths, and error or performance metrics — so we can improve reliability and product design. Analytics may be first-party, provided by our infrastructure partners, or enabled via a privacy-conscious analytics provider. Where analytics are enabled, they are used for product and site improvement, not for selling ads. If analytics are disabled for a property, this category may not apply to that property.

Marketing / advertising. Used to deliver, measure, or personalize advertising across sites. IdonAI does not currently use marketing or advertising cookies on idonai.com or Quark. If we introduce them in the future, we will update this Policy, identify the providers, and obtain consent where required by law before setting non-essential marketing cookies.

5. Cookie and similar-technology table

The following table lists cookies and similar technologies that are commonly used on the Services. Names may vary slightly by environment, provider version, or subdomain. “Duration” describes typical lifetime; session cookies expire when you close the browser or when the server session ends. Entries marked “if enabled” apply only when that capability is turned on for the relevant property.

Name	Category	Purpose	Duration	Provider
sb-*-auth-token / Supabase auth cookies (names may vary)	Strictly necessary	Maintain authenticated sessions for account access to Quark and related authenticated surfaces; refresh and validate login state securely.	Session to persistent (provider-configured; often weeks for refresh tokens, shorter for access tokens)	IdonAI / Supabase (authentication infrastructure)
sb-*-auth-token-code-verifier (or equivalent PKCE verifier)	Strictly necessary	Support secure OAuth / PKCE authentication flows and prevent authorization-code interception.	Short-lived / session	IdonAI / Supabase
CSRF / request-integrity token (if applicable to a form or API surface)	Strictly necessary	Protect state-changing requests against cross-site request forgery.	Session or short-lived	IdonAI
Load balancer / edge routing cookies (names vary by CDN or host)	Strictly necessary	Route traffic consistently, maintain affinity where required, and support availability and DDoS protections.	Session to hours	IdonAI hosting / CDN partners
idon-cookie-consent (or equivalent consent preference)	Strictly necessary / preferences	Store your cookie-banner or preference-center choices so we do not re-prompt on every visit and can honor non-essential opt-ins/opt-outs.	Up to 12 months (typical)	IdonAI
idon-theme (localStorage)	Functional / preferences	Remember light or dark theme preference across visits on the marketing site and related UI.	Persistent until cleared (localStorage; not a HTTP cookie)	IdonAI
idon-search-recent (or similar localStorage key)	Functional / preferences	Store recent on-site search queries on your device to improve navigation convenience. Not sent to advertising networks.	Persistent until cleared (localStorage)	IdonAI
Analytics identifier / _ga / _gid / plausible_* / similar (if enabled)	Analytics / performance	Measure aggregated traffic, page performance, and product usage to improve the Services. Configuration aims to minimize personal data where feasible.	Session to 24 months (provider-dependent; if enabled)	IdonAI and/or analytics provider (if enabled)
Performance / RUM / error telemetry (if enabled)	Analytics / performance	Collect client performance timings and error signals to diagnose outages and regressions.	Session to months (if enabled)	IdonAI and/or observability partners (if enabled)
Marketing / ad cookies	Marketing	Not currently used on IdonAI properties.	N/A	N/A — not in use

Authentication cookie names and attributes are determined in part by our authentication provider and may change when we upgrade infrastructure. Security-related cookies may be marked Secure and, where appropriate, HttpOnly and SameSite to reduce certain classes of attack.

If you use Quark or the API from a third-party client, that client may store tokens or credentials using its own mechanisms. Those mechanisms are governed by the client’s policies in addition to any IdonAI terms that apply to your account.

6. Legal basis

Where the Australian Privacy Principles, the GDPR/UK GDPR, or similar laws apply, our use of cookies and similar technologies is based on one or more of the following grounds, depending on the technology and context:

Strictly necessary processing: required to provide a Service you request (for example, signing in, maintaining security, load balancing, or storing consent preferences). Consent is generally not required for these technologies under ePrivacy-style rules, though transparency still applies.
Consent: where required for non-essential cookies (for example, certain analytics or any future marketing cookies), we will seek consent before setting them, and you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Legitimate interests: where permitted, we may rely on legitimate interests for limited measurement, security, and product improvement that do not override your rights — balanced against your expectations and available controls.
Contractual necessity: processing needed to perform our agreement with you (for example, authenticating API access under your account).

For more detail on personal information categories, retention, international transfers, and your rights, see our Privacy Policy. Cookie-specific choices are described in the next section.

7. How to manage cookies and similar technologies

You can control cookies and similar technologies in several ways. The options available depend on your browser, device, and whether a preference center is shown on a given IdonAI property.

IdonAI controls. Where we display a cookie banner or preference center, you can accept or reject non-essential categories and change your mind later (for example, by clearing the consent cookie or revisiting preference settings). Strictly necessary technologies cannot be disabled through the banner because the Services would not work securely without them.

Browser controls. Most browsers let you block or delete cookies, clear local storage, and set site-specific permissions. Instructions are typically available in your browser’s help documentation (for example, Chrome, Firefox, Safari, Edge). Blocking all cookies may prevent sign-in, preference persistence, and other core features.

Delete existing cookies and site data for idonai.com and quark.idonai.com if you want a clean slate.
Clear localStorage to reset theme and locally stored UI preferences.
Use private/incognito windows for sessions that should not persist after the window closes (subject to browser behavior).
Review third-party cookie blocking settings; aggressive blocking can break authentication or embedded resources.

Mobile and OS controls. Device-level tracking or advertising identifiers (where relevant to mobile apps we may offer) can often be limited in system settings. Web cookies on mobile browsers are managed through the browser’s settings similarly to desktop.

Analytics opt-out. If we enable a third-party analytics provider that offers an opt-out, we will link to that mechanism here or in the Privacy Policy when it is active. You may also use browser extensions or industry tools that limit analytics scripts, understanding that some product telemetry needed for security and reliability may still occur at the server level without client-side analytics cookies.

Global Privacy Control / similar signals. Where legally required and technically feasible, we will honor recognized browser-based opt-out preference signals for sale/sharing or targeted advertising. Because we do not currently use marketing cookies or sell personal information for advertising, the practical effect on IdonAI cookie behavior may be limited today; we will expand support as our practices and legal obligations evolve.

8. Do Not Track

Some browsers include a “Do Not Track” (DNT) setting that sends a signal to websites requesting that they not track the user across sites. There is no single industry standard for how websites should respond to DNT.

IdonAI does not currently alter cookie behavior solely in response to DNT signals. We do not use marketing cookies today, and we limit analytics to product and site improvement when enabled. We continue to monitor standards and legal requirements (including Global Privacy Control and similar mechanisms) and will update this section if our response practices change.

Regardless of DNT, you can use the browser and preference controls described above to limit non-essential client-side technologies.

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, providers, law, or our Services. When we make material changes, we will update the “Last updated” date at the top of this Policy (July 9, 2026 as of publication) and, where appropriate, provide additional notice (for example, a banner on the site or an in-product notice).

Your continued use of the Services after an updated Cookie Policy becomes effective constitutes acceptance of the revised Policy to the extent permitted by law. If you do not agree with changes, you should adjust your cookie settings, stop using the affected Services, or contact us as described below.

We encourage you to review this page periodically. Historical versions may be available on request to our privacy team for enterprise customers or where required by law.

10. Contact

Questions about cookies, similar technologies, or this Policy can be sent to our privacy team:

Privacy: privacy@idonai.com
Legal: legal@idonai.com
Support (product access issues after clearing cookies): support@idonai.com

Please include the URL you were visiting, your browser and device type, and a short description of your question or request. For data-subject rights requests (access, deletion, and similar), use the processes described in our Privacy Policy and email privacy@idonai.com.

Postal or entity details, where required for notices under applicable law, will be provided on request via legal@idonai.com. Governing law: the laws of New South Wales, Australia. Venue: the courts of New South Wales, Australia.

11. Related documents

This Cookie Policy is part of IdonAI’s broader legal and trust documentation. For a complete picture of how we handle information and operate the Services, see:

Privacy Policy — https://idonai.com/legal/privacy (personal information, retention, rights, international transfers).
Terms of Service — https://idonai.com/legal/terms (use of the Services, accounts, acceptable use).
Security overview — https://idonai.com/legal/security (technical and organizational measures; vulnerability disclosure).
Trust Center — https://idonai.com/trust (enterprise-oriented security and compliance summary).

If there is a conflict between a short in-product cookie notice and this Policy, this Policy controls for cookie-specific disclosures, except where a more specific consent record or enterprise agreement expressly provides otherwise.