Product: Heyz (heyz.ai)
Controller: JAWK AS, Norway · org.nr 936 250 319
Language: English
Version: 1.4 · Effective 14 October 2026
Contact: legal@heyz.ai
This Cookie Policy explains how Heyz uses cookies and similar local storage. It is not personalized legal advice.
This Cookie Policy explains how Heyz uses cookies and similar local storage. It should be read with the Privacy Policy and Terms.
1. What we use today
Heyz is a first-party product. We do not use third-party advertising cookies or trackers. With your consent, first-party Explore read counting uses a random browser identifier to count at most one document read per browser per 24 hours. Popular now uses a rolling seven-day count. We do not load external analytics scripts.
Explore read counting starts only after you choose Accept in the cookie banner. Essential only (reject non-essential) keeps the product working without optional read counting.
Your choice is stored in:
localStoragekeyheyz_cookie_consent- a first-party cookie of the same name (so the preference can be read on later visits)
That record is treated as essential — it remembers this choice so we do not ask on every page load.
2. Categories
Essential (always on)
Required to operate Heyz securely. These are not used for advertising.
| Name / type | Purpose | Duration (typical) |
|---|---|---|
| Convex Auth / session cookies | Keep you signed in; protect authenticated routes | Session / provider default |
| Security / CSRF-related cookies set by auth | Prevent session abuse | Session / provider default |
heyz_cookie_consent (cookie + localStorage) | Store Accept vs Essential only | Cookie: 12 months from your latest choice. localStorage: until you change your choice or clear site data |
__Host-heyz-region-verifier and __Host-heyz-region-return (cookies, HttpOnly) | When a regional Heyz app sends you through Heyz’s central sign-in, hold a random one-time verifier that ties the returning sign-in to this browser, and the Heyz page to return to | Up to 2 minutes; removed when the sign-in returns |
heyz_explore_reporter (sessionStorage) | Deduplicate reports you submit; created only when you report a document | Browser tab session |
heyz.adoptToken (sessionStorage) | Keep a sponsor link’s token in this tab while you sign in and review the request; created only when you open a sponsor link. The sponsor link you open contains the token in its web address; for an open sponsor link, the page then removes it from the address bar | This browser tab only; removed when you approve or decline the request, or when the link no longer works |
heyz.socialSignInReturn (sessionStorage) | Before you leave for a social sign-in provider, keep the Heyz page to return to, the sign-in purpose and any email address you entered, so a refused sign-in can bring you back | This browser tab only; read once, ignored after 15 minutes, and removed once you are signed in |
heyz.socialLink (sessionStorage) | Remember which provider you chose to link under Account, so the sign-in page can explain a link that came back without completing | This browser tab only; read once, ignored after 15 minutes, and removed when you are back on Account |
heyz:sign-in-reserve:not-now:<account id> (sessionStorage) | Hide the sign-in reserve reminder for your account in this tab; written only after you choose Not now and not sent to the server | This browser tab only; removed when you sign out |
| Organization sign-in cookies (cookies, HttpOnly) | Only if organization pages on heyz.ai are available to you and you use them: first-party cookies set by Heyz’s regional organization servers on heyz.ai subdomains. They support organization sign-in, joining an organization from an invitation, short-lived setup of sign-in through your organization’s identity provider, and staying signed in to an organization in this browser | Sign-in and setup cookies: up to 5 minutes. Organization account session cookie: up to 8 hours. Organization single sign-on session cookie: up to 8 hours; the single sign-on session itself ends after 30 minutes without activity, even though the cookie can stay in your browser until it expires. Invitation cookie: up to 24 hours, and never past the invitation’s expiry. Signing out of an organization session removes only that session’s cookie; any other organization session cookies you have stay until you sign out of their own sessions or each cookie expires; some sign-in and setup cookies are removed as soon as their flow finishes |
| Organization workflow state (sessionStorage) | Only if organization pages on heyz.ai are available to you and you use them: short-lived state that lets the current tab finish an organization sign-in, or resume or retry an organization operation. Depending on the page, this can be a pending organization sign-in (the workspace, a one-time sign-in challenge and any document to open afterwards), a draft, a pending command, an approval or internal publication, sharing, an invitation or membership request, people, team or agent changes, or domain, policy, SCIM, SSO or just-in-time provisioning settings | This browser tab only; some entries are removed while a task is handled, and any that remain are cleared when you close the tab. A pending organization sign-in is read once when you return from that sign-in and removed then or when another starts; it is not accepted after 5 minutes |
Exact cookie names for Convex Auth are set by the auth library and may change. They are first-party to the Heyz host.
The organization rows describe cookies and storage that may occur when organization pages are used; this does not mean organization features are active for you or your account. They are not used for advertising or analytics.
The global app uses the same sign-in session when accessing EU and US artifacts. Direct regional API requests use bearer authorization and omit cookies. Account cookies and tokens are not sent to the artifact renderer. These authentication mechanisms do not store artifact content in session cookies.
Non-essential (off until you Accept)
| Type | Status |
|---|---|
| Explore reader identifier | localStorage key heyz_explore_reader, a random identifier created after Accept. Sent only when an Explore document is opened, then hashed in its owning backend. Read-event hashes expire after seven days; the local identifier remains until site data is cleared. It is not linked to your account or shared with the category-review providers. |
| Advertising / retargeting | Not used. |
| Social plugins that set third-party cookies | Not used. |
Optional Google sign-in, when an operator enables it, is an authentication flow (essential to that feature), not an analytics cookie we set on the landing page.
3. Sandbox artifacts
Interactive HTML you view in the separate sandbox origin is blocked from using the Heyz app’s cookies, localStorage, and account session. Artifact pages are not a place we plant ad cookies.
4. How to choose
On first visit a banner offers:
- Accept — essential cookies plus optional Explore read counts;
- Essential only — reject non-essential. The service still works (sign-in, artifacts, sharing).
Use Cookie settings in the footer to change your mind. You can also clear site data in your browser.
Norwegian / EEA rules treat non-essential cookies as requiring consent. Essential cookies do not.
5. Changes
We will update /cookies if these technologies change. We will not load them retroactively under an old “Essential only” choice.
6. Contact
JAWK AS, Norway · org.nr 936 250 319