This Cookie Policy explains how JARAI STUDIO Ltd ("JARAI", "we", "us") uses cookies and similar technologies on jarai.studio and the JARAI STUDIO platform. We have designed our cookie usage to be as privacy-preserving as possible.
1. What are cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work correctly, to remember your preferences, and to provide site owners with information about how their sites are used.
Similar technologies include local storage, session storage, and browser fingerprinting. Our position on each of these is described below.
2. Cookies and storage we use
We classify everything we store on your device into three buckets: Strictly Necessary (required for the service to function), Functional (remembers preferences that improve the experience), and Analytics (aggregate, anonymous usage). We do not use advertising or cross-site tracking storage on either surface. Under PECR and UK GDPR, strictly necessary storage does not require consent.
Marketing site (www.jarai.studio)
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
jarai_ref |
Cookie (first-party, .jarai.studio) |
Stores a 6-character referral code from a ?ref= URL parameter so we can attribute new sign-ups to the friend who referred you. Set only when you arrive with a ?ref= link. |
30 days | Functional |
jarai-theme |
Cookie (first-party, .jarai.studio) + localStorage mirror |
Remembers your light/dark colour-mode choice and shares it across every JARAI STUDIO web property (this site, the Studio Console, the Client Portal, the Developer Portal, and the help centre) so you don't have to choose again on each one. | 1 year | Functional |
The jarai_ref cookie stores only a non-personal, opaque 6-character code.
It does not identify you, track your browsing across sites, or enable advertising. You can
opt out of attribution by visiting jarai.studio without a
?ref= parameter, or by clearing the cookie at any time using your browser
settings.
Studio Console (console.jarai.studio)
When you sign in to the Studio Console, the application stores authentication and session state on your device so you don't have to re-authenticate on every page load and so the UI can rehydrate quickly after a reload. Everything below is strictly necessary for the service to function.
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
Microsoft Entra External ID session cookies (x-ms-cpim-*, esctx, buid, others set by Microsoft) |
Cookie (third-party, scoped to login.microsoftonline.com) |
Maintain the OAuth sign-in state correlation. Set by Microsoft Entra External ID when you click "Sign in" and complete the authentication redirect. | Session and persistent cookies set by Microsoft (durations controlled by Microsoft) | Strictly Necessary |
jarai-theme |
Cookie (first-party, .jarai.studio) + localStorage mirror |
Shared colour-mode choice — see the Marketing site table above. | 1 year | Functional |
MSAL session cache (multiple keys, prefix msal.* and per-application identifier) |
sessionStorage | Holds the active access token, account record, and request state during the OAuth redirect. Used by the Microsoft Authentication Library (MSAL) on the Studio Console. | Until you close the browser tab | Strictly Necessary |
jarai_identity_type |
localStorage | Records which sign-in path you used (entra / externalId / google) so we can rehydrate the right authentication provider after a page reload. |
Persistent (until you sign out or clear site data) | Strictly Necessary |
jarai_cached_roles |
localStorage | Caches the role array assigned to your account so the UI can hide / show role-restricted features without a network round-trip on reload. Cleared on sign-out. | Persistent (until you sign out or clear site data) | Strictly Necessary |
jarai_google_token, jarai_google_token_expires_at, jarai_google_user, jarai_refresh_token |
localStorage | Stores your Google OAuth access token, its expiry timestamp, a refresh token, and your Google profile (sub, email, name). Set only when you choose "Continue with Google" sign-in; not present otherwise. Cleared on sign-out. |
Persistent until expiry or sign-out | Strictly Necessary (Google sign-in path only) |
jarai-last-account:<your account id> |
localStorage | Remembers the account you last selected so dashboards and productions default back to it when you return. Keyed to your own sign-in so it never shows another signed-in person's last selection. | Persistent (until you sign out or clear site data) | Strictly Necessary |
jarai-color-mode, jarai-bg-animation, jarai-chat-font |
localStorage | Per-device appearance preferences (colour mode, background animation, chat font). | Persistent (until you clear site data) | Functional |
jarai-sidebar-collapsed |
localStorage | Remembers whether you collapsed the navigation sidebar. | Persistent (until you clear site data) | Functional |
jarai_install_dismissed |
sessionStorage | Records that you've dismissed the "Install JARAI as an app" PWA install banner during this browser session so we don't keep prompting. | Until you close the browser tab | Functional |
| Interface dedup flags (a small "welcome" animation, an unavailable-page tip, an offline-page tip, a dismissible allowance notice) | sessionStorage | Ensure a one-off UI hint shows at most once per browser session rather than every time you navigate. | Until you close the browser tab | Functional |
| A stale-version reload guard | sessionStorage | Ensures a page automatically reloads at most once when your browser has cached an outdated version of the application after a deploy, rather than looping. | Until you close the browser tab | Strictly Necessary (error recovery) |
JARAI_QUERY_CACHE_v3 |
localStorage | Offline cache for the Studio Console's data layer. Lets the application show stale-but-recent data when your network drops out, with an "offline" indicator. Capped to 24h and tied to the build version so it auto-invalidates on each deploy. | 24 hours | Strictly Necessary (offline support) |
Client Portal (portal.jarai.studio)
The Client Portal is an invite-only application for customers' own end clients to review
and approve productions. Everything it stores is strictly necessary for the requested
service; it does not use the shared jarai-theme cookie.
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
portal_access_token |
sessionStorage | Active access token authenticating your requests to the portal. | Until you close the browser tab | Strictly Necessary |
portal_refresh_token |
sessionStorage | Obtains a new access token without asking you to sign in again while your session is active. | Until you close the browser tab | Strictly Necessary |
Developer Portal (developers.jarai.studio)
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
jarai-theme |
Cookie (first-party, .jarai.studio) + localStorage mirror |
Shared colour-mode choice — see the Marketing site table above. | 1 year | Functional |
jarai_devportal_apikey |
sessionStorage | Your own Partner API key, entered so you can preview your live usage figures. Sent only to api.jarai.studio, never to a third party. |
Until you close the browser tab | Strictly Necessary |
The Developer Portal also uses Cloudflare Web Analytics — see the "Analytics" section below. It does not use cookies.
Help centre (help.jarai.studio)
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
jarai-theme |
Cookie (first-party, .jarai.studio) |
Shared colour-mode choice — see the Marketing site table above. | 1 year | Functional |
starlight-theme |
localStorage | The documentation framework's own theme preference, kept in sync with the shared jarai-theme cookie above. |
Persistent (until you clear site data) | Functional |
The help centre also uses Cloudflare Web Analytics — see the "Analytics" section below. It does not use any other cookies.
If you sign in with "Continue with Google", Google's own session cookies are set in the
accounts.google.com domain scope by Google itself, as part of the OAuth flow
you initiated. We do not control those cookies; see
Google's cookies policy
for details.
Client Portal (portal.jarai.studio)
✦ BL-1573 — If your organisation has invited you as a Client Portal user, the portal stores your session credential on your device so you don't have to sign in again on every page load. Everything below is strictly necessary for the service to function; nothing here is used for analytics or tracking, and no third-party storage is set on this application.
| Name | Type | Purpose | Duration | Classification |
|---|---|---|---|---|
portal_access_token |
sessionStorage | Holds the active access token that authenticates your requests to the portal while you review, approve or reject productions. | Until you close the browser tab | Strictly Necessary |
portal_refresh_token |
sessionStorage | Used to obtain a new access token without asking you to sign in again while your session remains active. | Until you close the browser tab | Strictly Necessary |
Analytics — Cloudflare Web Analytics
We use Cloudflare Web Analytics to understand how visitors use www.jarai.studio. Cloudflare Web Analytics is a privacy-first analytics tool that is fully compliant with GDPR, UK GDPR, PECR, and CCPA.
Cloudflare Web Analytics does not use cookies and does not store personal data. Specifically:
- No cookies are set, on any domain
- No IP addresses are stored
- No device fingerprints or persistent identifiers are created
- No cross-site or cross-session tracking occurs
- Cloudflare does not track individual visitors
- Data is stored only as aggregate, anonymised statistics (page views, referrer sources, geographic region at country level, browser type)
Because Cloudflare Web Analytics does not use cookies or personal data, no cookie consent banner is required for analytics under GDPR, UK GDPR, or PECR. You can read more about Cloudflare's approach at cloudflare.com/web-analytics.
3. What we do not use
JARAI does not use:
- Advertising or targeting cookies — we run no ad campaigns that require retargeting pixels
- Third-party tracking cookies — we do not embed tracking from Facebook, Google Ads, Twitter/X, or any other advertising network
- Social media buttons or embeds — no Facebook, Twitter, or LinkedIn widgets that set third-party cookies
- Browser fingerprinting — we do not use fingerprinting as a cookie-less tracking alternative
4. Managing cookies
You can control and delete cookies through your browser settings. Most modern browsers allow you to:
- View all cookies stored on your device and delete specific cookies
- Block cookies from specific websites
- Block all third-party cookies while allowing first-party cookies
- Clear all cookies when you close the browser
Browser cookie settings
- Google Chrome: Settings → Privacy and security → Cookies and other site data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Apple Safari: Preferences → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies
Note that clearing site data for console.jarai.studio (cookies +
localStorage + sessionStorage) will sign you out of the Studio Console immediately, and
MSAL will need to re-authenticate you against Microsoft Entra External ID on next visit.
You can sign back in at any time; no production data is lost.
Third parties used by the service
The following third parties may set storage in their own domain scope as a strictly necessary part of the integration. None of these are advertising or cross-site tracking third parties.
- Microsoft Entra External ID (
login.microsoftonline.com) — OAuth sign-in provider for the Studio Console. Sets session and persistent cookies in its own domain scope as part of the sign-in flow you initiate. - Google OAuth (
accounts.google.com) — only when you choose "Continue with Google" sign-in. Google's own cookies, set by Google. - Cloudflare Web Analytics — cookieless by design (see § 2 above).
5. Changes to this policy
We will update this Cookie Policy if we introduce new cookies or tracking technologies. We will notify you of material changes by email and by a notice on jarai.studio before changes take effect. The "last updated" date at the top of this page reflects the most recent revision.
6. Contact
For any questions about our use of cookies or similar technologies:
- All enquiries: Contact us - this reaches the right team and gives you a reference you can quote.
- Privacy enquiries by email: privacy@jarai.studio
For how we handle your personal data more broadly, see our Privacy Policy.
Change log
Each version of this page and what changed in it, newest first. Rows dated before 5 October 2026 are edits made in place before our legal pages were versioned, listed from the site's history so that every change is on the record.
| Version | Date | Change |
|---|---|---|
| 1.0 | All five JARAI web properties covered. | |
| 1.0 | The Client Portal’s storage disclosed. | |
| 1.0 | Requests routed through the contact page. | |
| 1.0 | Regulator references linked. | |
| 1.0 | Company name changed to JARAI STUDIO Ltd. | |
| 1.0 | Full per-item inventory, including the Studio Console. | |
| 1.0 | The referral-attribution cookie added. | |
| 1.0 | Website analytics: Plausible replaced by Cloudflare Web Analytics. | |
| 1.0 | First published. |