Cookie policy
Invokely uses only the cookies it needs to sign you in and to protect sign-in forms from abuse. There are no analytics, advertising or social media cookies, and we do not track you across other websites.
What cookies are
A cookie is a small file that a website stores in your browser and reads on later visits. Similar technologies, such as local storage, work in a comparable way. This policy covers all of them.
Cookies we set
- __Host-invokely_session: keeps you signed in after you sign in. It holds a random identifier; we store only a hash of it. It lasts 30 days, or until you sign out. First-party, strictly necessary.
- __Host-invokely_oauth: protects Google sign-in against forged requests by linking the start and the end of the sign-in. It lasts 10 minutes and is deleted when sign-in completes. First-party, strictly necessary.
Both cookies are sent only over HTTPS and are not readable by scripts on the page.
The API and the MCP server do not use cookies. They authenticate with API keys or OAuth tokens.
Your color theme
If you choose Light or Dark in the theme switch, your browser keeps that choice in local storage on your device under the name invokely-theme. It never leaves your device and we cannot read it. Choosing System removes it. It is a setting you asked for, so it needs no consent.
Cloudflare Turnstile
Our sign-in forms include Cloudflare Turnstile, a security check that tells people from automated bots without asking you to solve puzzles. The check loads from challenges.cloudflare.com.
To run the check, Cloudflare processes signals such as your IP address, TLS fingerprint, user agent and the site you are on. Cloudflare states that it uses these signals only to detect and block bots and to improve that detection, and that it does not use them for advertising or to track you across sites. Cloudflare classes the cookies and storage used by its security challenges as strictly necessary.
Cloudflare's Turnstile privacy addendum, at cloudflare.com/turnstile-privacy-policy, describes this processing in detail. Turnstile runs only on pages with a sign-in form.
Why we do not ask for consent
Article 22.2 of the Spanish Information Society Services Act (LSSI) requires consent for cookies, except for those strictly necessary to provide a service you have asked for. The Spanish Data Protection Agency (AEPD) includes session, authentication and security cookies in that exemption.
All the cookies and storage described here fall within it, so we do not show a cookie banner. If we ever add cookies that need consent, we will ask for it before setting them.
How to control cookies
You can block or delete cookies in your browser settings. If you block the cookies above, you will not be able to sign in to the dashboard. The API and the MCP server work without cookies.
Changes to this policy
We will update this policy if the cookies we use change. The date at the top shows the latest version.