Cookie Policy

Website vs. app

This policy is about this website (nyxai.uk). The Nyx AI desktop app is separate and uses no cookies, analytics, or telemetry for tracking, see the Privacy Policy and threat model for the app’s network behaviour.

Two app surfaces still handle cookies without creating any Nyx AI tracking: your own project code can set cookies inside the embedded preview, and browser-rendered web search may receive a provider’s cookies in a short-lived managed profile that Nyx AI discards. Neither feeds analytics.

This page is published in English only, and the English text is the binding version; any translation elsewhere on this site is provided for convenience only. Where this page and the app-bundled Privacy Policy describe the same processing, the app-bundled document governs the application and this dated page governs current website behaviour.

What this website stores

No first-party cookies, and no preference or analytics storage. Our website code sets no cookies of its own and does not store your theme, language, or consent choice in cookies or browser storage. The theme toggle lasts only for the current page session. On translated pages, your language is carried in the address itself (a prefix such as /de/…) rather than saved in your browser. On an English-only page, the shared navigation shell can temporarily keep the language you selected in memory while the body remains English; reloading or directly opening an unprefixed address returns the shell to English. We do not load Google Analytics or any other analytics or advertising service, and set no analytics or advertising cookies.

If that ever changes, you will read it here first. We may in future introduce cookieless, aggregate measurement that sets no cookie and builds no profile. If we do, we will update this page and the Privacy Policy to say what it collects, who processes it, and how to object before that measurement begins. The same applies to any non-essential cookie or similar technology.

Necessary Cloudflare security technologies. Our source code sets none of these itself. The Cloudflare services protecting the deployed site can conditionally issue the following strictly necessary technologies, depending on the security options enabled for the domain:

• __cf_bm, only where Bot Management or Bot Fight Mode is active; Cloudflare says it expires after 30 minutes of continuous inactivity.
• _cfuvid, only where the Cloudflare rate-limit configuration enables its unique-visitor option, to distinguish visitors sharing an IP address.
• cf_clearance, after a Cloudflare challenge or when optional Turnstile pre-clearance is enabled; its lifetime is the domain’s configured Challenge Passage period. The default Turnstile widget instead issues a one-time token for server-side verification.

These technologies support bot, abuse and availability controls rather than advertising or cross-site tracking. Cloudflare controls their contents and service-specific retention. See Cloudflare’s current cookie list and our Privacy Policy. We verify the live deployment against this list when its Cloudflare configuration changes.

Form protection (Cloudflare Turnstile)

The Turnstile widget is loaded from challenges.cloudflare.com and appears only on the two pages that carry a form, the Pro waitlist and the support-payment page, and only where a Turnstile key is configured for the deployment. It issues a single-use token that our server verifies; we keep no copy of the token. When the shared protection store (Upstash Redis) is available, it keeps a short-lived hashed-token marker for about five minutes so the same token cannot be replayed. These identifiers are pseudonymous, are used only for security, rate limiting and preventing duplicate charges, never for advertising or cross-site tracking, and expire automatically; the Privacy Policy names the processors and retention periods. Cloudflare may use short-lived storage on its own challenge origin to run that check; we do not read it. See Cloudflare’s Turnstile documentation.

One-time support payments

Support payments are handled by Stripe on Stripe’s own pages: choosing to pay redirects you to Stripe’s hosted checkout, where Stripe may set its own cookies under its own policy. Your full card number and CVC never reach us; we may receive billing and transaction data and limited card metadata such as the last four digits. A support payment buys no goods, services, licence, or product access. See our Privacy Policy.