Product: Heyz (heyz.ai) Controller: JAWK AS, Norway · org.nr 936 250 319 Language: English Draft version: 1.0 · 14 September 2026 Contact: legal@heyz.ai (verify this mailbox is monitored)
Draft — not legal advice. This document is a working draft for legal counsel review.
This Cookie Policy explains how Heyz uses cookies and similar local storage. It should be read with the Privacy Policy and Terms.
1. What we use today
Heyz is a first-party product. We do not use third-party advertising cookies or trackers. We do not currently load analytics (no Plausible, PostHog, Google Analytics, or similar).
If we add non-essential scripts later, they will load only after you choose Accept in the cookie banner. Essential only (reject non-essential) keeps the product working without those scripts.
Your choice is stored in:
localStoragekeyheyz_cookie_consent- a first-party cookie of the same name (so the preference can be read on later visits)
That record is treated as essential — it remembers this choice so we do not ask on every page load.
2. Categories
Essential (always on)
Required to operate Heyz securely. These are not used for advertising.
| Name / type | Purpose | Duration (typical) |
|---|---|---|
| Convex Auth / session cookies | Keep you signed in; protect authenticated routes | Session / provider default |
| Security / CSRF-related cookies set by auth | Prevent session abuse | Session / provider default |
heyz_cookie_consent (cookie + localStorage) | Store Accept vs Essential only | Up to 12 months, or until you change it |
Exact cookie names for Convex Auth are set by the auth library and may change. They are first-party to the Heyz host.
Non-essential (off until you Accept)
| Type | Status |
|---|---|
| Analytics | None shipped. The app has a load-gate so a future first-party or privacy-oriented analytics script cannot run without Accept. |
| Advertising / retargeting | Not used. Will not be invented for this draft. |
| Social plugins that set third-party cookies | Not used. |
Optional Google sign-in, when an operator enables it, is an authentication flow (essential to that feature), not an analytics cookie we set on the landing page.
3. Sandbox artifacts
Interactive HTML you view in the separate sandbox origin is blocked from using the Heyz app’s cookies, localStorage, and account session. Artifact pages are not a place we plant ad cookies.
4. How to choose
On first visit a banner offers:
- Accept — essential cookies, and permission for non-essential scripts if we add any;
- Essential only — reject non-essential. The service still works (sign-in, artifacts, sharing).
Use Cookie settings in the footer to change your mind. You can also clear site data in your browser.
Norwegian / EEA rules treat non-essential cookies as requiring consent. Essential cookies do not.
5. Changes
We will update /cookies if we introduce analytics or other non-essential technologies. We will not load them retroactively under an old “Essential only” choice.
6. Contact
JAWK AS, Norway · org.nr 936 250 319 legal@heyz.ai