COMPAS3 AI Cookie Policy
Effective date: July 22, 2026
This policy explains how COMPAS3 AI uses cookies and similar technologies on compas3.ai and in the Aletheia application at app.aletheia.compas3.ai.
The short version
We only use cookies that are strictly necessary to sign you in and keep you signed in. We do not use advertising cookies, marketing or retargeting cookies, social media cookies, or third-party analytics cookies. We do not track you across other websites, and we do not sell or share cookie data with advertising networks.
Because we set no non-essential cookies, there is nothing to consent to and we do not show a cookie consent banner. If that changes, we will ask for your consent before setting any new category of cookie, and update this policy first.
What cookies are
Cookies are small text files a website stores in your browser. They let a site remember things between page loads, such as the fact that you have signed in. A first party cookie is set by the site you are visiting. A third party cookie is set by another company through that site. We use first party cookies only.
Cookies we set
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| sb-<project>-auth-token | COMPAS3 AI (first party, via Supabase) | Keeps you signed in and carries your session between compas3.ai and the Aletheia application. Large values are split across numbered cookies such as sb-<project>-auth-token.0. | 7 days, refreshed while you stay signed in |
| sb-<project>-auth-token-code-verifier | COMPAS3 AI (first party, via Supabase) | Short-lived value used to complete a sign in, password reset or email confirmation securely. | Deleted as soon as sign in completes |
| sidebar_state | COMPAS3 AI (first party) | Remembers whether you collapsed the navigation sidebar in the Aletheia application, so the page does not jump on your next visit. | 7 days |
The two session cookies are strictly necessary. They exist only to authenticate you and secure your session, and they cannot be switched off without making it impossible to sign in. The sidebar_state cookie only records an interface preference you set yourself. None of them are used to profile you or to measure marketing performance, which is why none of them require consent.
Why they are set on a shared domain. Our session cookies are scoped to .compas3.ai so that signing in on compas3.ai also signs you in to the Aletheia application at app.aletheia.compas3.ai. They are marked Secure and use SameSite=Lax, which means your browser does not send them to us from other websites.
Other technologies we use
Page performance measurement. Our marketing site uses Vercel Speed Insights to measure how quickly pages load. It does not set cookies and does not build a profile of you. It reports aggregate performance data such as load timings, along with the page URL, approximate location and browser type.
Local and session storage. The Aletheia application stores small amounts of data in your browser's local and session storage, for example the details of a verification you have just started so the page can recover if it reloads, and a marker recording that a one-time data migration has run. This stays on your device, is not used for tracking, and is cleared when you clear your browser data.
Email. We do not use tracking pixels in our transactional emails.
Managing cookies
You can delete existing cookies and block future ones through your browser settings. Every major browser lets you do this, usually under Privacy or Security. Because the only cookies we set are the ones that keep you signed in, blocking them will prevent you from using the Service while signed in.
Signing out clears your session cookies.
Changes to this policy
If we start using cookies for analytics, personalisation or marketing, we will update this policy and obtain your consent before those cookies are set.
Contact
Questions about this policy can be sent to [email protected]. See also our Privacy Policy.