1. What cookies we use
A cookie is a small text file set on your device by a website. Some cookies last only for the current session; others persist for a defined period. The Service also uses similar technologies — local storage, session storage, and server-set tokens — that perform the same function. This policy treats all of them as "cookies" for readability.
1.1The cookie table in §4 is the current route disclosure. The maintained implementation and consent surface remain authoritative for active cookies.
1.2We publish this policy alongside the Privacy Policy. They're designed to be read together — the Privacy Policy explains what we do with personal information in general; this one explains the specific role cookies play.
2. Categories
Materially rewritten 2026-08-08, pending counsel review.
We group storage into two active categories — strictly necessary and analytics — plus two reserved consent classes (marketing, functional) that no processing currently runs under. Airheart sets no advertising cookies.
Keep you signed in and the Service working.
Session tokens, CSRF tokens, and load-balancer routing cookies. Without these, sign-in, checkout, and most of the product fail. Can't be turned off, because the Service won't work without them.
ON · always · requiredTell us which pages render too slowly.
Product analytics — page views, feature-usage events, and, with this consent, session recording of your in-app interactions (LogRocket). Opt-in only, on both paths: the tools load in your browser only after you accept, and server-side analytics events are dropped unless your stored consent grants them. No cross-site advertising trackers.
OFF by default · opt-in in the bannerMarketing and functional — reserved, currently inactive.
The consent surface reserves marketing and functional classes, but no processing currently runs under either — declining or accepting them changes nothing today. UI settings (locale, dismissed prompts) are ordinary app state in your browser's storage, not a tracking category.
Inactive · no processing runs under these classes2.1What this route does not independently claim. Advertising-cookie, cross-site tracking, resale, and social-widget commitments must match the maintained cookie inventory and consent implementation.
2.2This policy is narrower than the law requires. That's intentional; we'd rather leave capacity for cookies on the table than set ones we don't need.
3. How to manage preferences
You're in charge of the optional categories. Strictly necessary cookies can't be disabled from within Airheart — but you can disable all cookies in your browser settings, with the caveat that the Service will mostly stop working if you do.
3.1In-product control. Change your consent at any time from Settings → Security in the app. Changes apply immediately and persist across devices when you're signed in.
3.2The banner. The first time you visit, a plain banner at the bottom of the screen asks you to accept or reject the optional categories. Reject is as easy as accept — same button size, same visual weight, no dark patterns.
3.3Browser controls. All modern browsers let you view, block, or delete cookies. The exact steps depend on your browser — search "manage cookies" in its help docs.
4. Third-party cookies
Materially rewritten 2026-08-08, pending counsel review.
Some cookies on Airheart may be set by service providers for authentication, payments, or error tracking. Provider status and purpose should match the maintained Sub-processor List.
| Name | Category | Purpose | Set by | Retention |
|---|---|---|---|---|
airheart.consent-preferences | Strictly necessary | Local-storage record of your consent decision so we don't re-prompt on every load. | Airheart (first-party) | Until cleared |
airheart:anonymous-tracking-id | Analytics | A random identifier written to local storage on first visit, before the banner is answered. It is transmitted nowhere unless you consent to analytics; with consent it joins your analytics events. | Airheart (first-party) | Until cleared |
| Firebase auth persistence (IndexedDB) | Strictly necessary | Keeps you signed in across page loads. | Google Firebase | Until sign-out |
_ga, _ga_* | Analytics | Google Analytics 4 measurement. Loads only after analytics consent. | Up to 24 months | |
rl_* | Analytics | RudderStack event delivery identifiers. Loads only after analytics consent. | RudderStack | Until cleared |
AMP_* | Analytics | Amplitude product analytics. Loads only after analytics consent. | Amplitude | Until cleared |
_lr_* | Analytics | LogRocket session recording — captures your in-app interactions for debugging and product improvement. Loads only after analytics consent. | LogRocket | Until cleared |
__stripe_mid, __stripe_sid | Strictly necessary | Stripe fraud prevention. Set only on pages that load the payment SDK. | Stripe | 12 months / 30 minutes |
__cf_bm | Strictly necessary | Bot-management token for our CDN. Prevents automated abuse of the Service. | Cloudflare | 30 minutes |
4.1Third-party cookies are bound by the third party's own policies in addition to ours. Stripe's and Cloudflare's cookies are strictly necessary for the services they provide and run regardless of consent. Google Analytics, RudderStack, Amplitude, and LogRocket load only after analytics consent. Two things run before the banner without storing an identifier: Cloudflare Web Analytics, a cookieless aggregate performance beacon, and the anonymous ID above, which is written locally but transmitted nowhere without consent.
4.2If we add or remove a cookie, this table is updated as part of the change. The effective date at the top reflects the most recent edit.
5. Updates
5.1This policy is versioned.
5.2Material changes — new categories, new third-party cookies, or changes to retention — follow the maintained policy and consent-notice process. You should get a fresh opportunity to review optional preferences when the consent surface changes.
5.3Non-material changes (typo fixes, reformatting, new cookie variants of an existing purpose) take effect on publication.
Questions about cookies
If something in the table above looks wrong, or a cookie is being set that shouldn't be, let us know. Cookie reports are routed to the privacy review flow.
privacy@airheart.comPostal address
Airheart Inc.
Attn: Privacy
1401 Lavaca Street, Unit #284
Austin, TX 78701
United States
See also: Privacy Policy and Sub-processor List.