Cookie Policy
Effective 1 September 2026. Last updated 3 September 2026.
This policy explains the cookies and similar technologies used on
elaichi.ai and app.elaichi.ai by Yin Yang, Inc. (dba Elaichi). It
supplements the Privacy Policy.
The short version
Nothing but strictly necessary cookies is set until you accept. On your first visit you are asked to choose. Until you do — and permanently if you reject — no analytics or advertising script runs and none of their cookies is set. You can change your mind at any time through the Cookie settings link in the footer.
We also honour the Global Privacy Control browser signal: if your browser sends it and you have not made an explicit choice, we treat that as a rejection and load nothing.
Categories
| Category | Consent needed? | What it covers |
|---|---|---|
| Strictly necessary | No — required for the service | Signing in, remembering your consent choice, and security |
| Analytics and advertising | Yes — opt-in | Google Tag Manager, Google Analytics 4, Google Ads measurement, and product analytics |
Strictly necessary cookies
| Name | Where | Purpose | Duration |
|---|---|---|---|
cookie_consent |
elaichi.ai |
Records whether you accepted or rejected non-essential cookies, so you are not asked again. SameSite=Lax; Secure. |
180 days |
The application also sets a strictly necessary sign-in cookie, flagged
HttpOnly, Secure and SameSite=Lax, so it is unreadable to JavaScript and
not sent on cross-site requests. It exists solely to keep you signed in.
None of these can be disabled: without them you could not sign in, and we could not remember your cookie choice.
Analytics and advertising cookies
These are set only after you accept. We load Google Tag Manager
(container GTM-KXKJ3L3Q), which in turn loads Google Analytics 4 and Google
Ads measurement.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes one visitor from another | 2 years |
_ga_<container-id> |
Google Analytics | Maintains analytics session state | 2 years |
_gcl_au |
Google Ads | Measures whether an ad led to a signup | 90 days |
Google acts as our processor for analytics, under Google's data processing terms. Analytics data is retained for 14 months, and we do not enable the "reset user data on new activity" setting, so data ages out from collection rather than being extended each time you return.
We have not enabled Google Signals, so Google does not build a cross-device profile of you from our site.
Because our Google Ads measurement discloses identifiers to Google for advertising purposes, this counts as "sharing" for cross-context behavioral advertising under California law. Rejecting cookies — or sending Global Privacy Control — stops it. See the CCPA Notice.
Browser storage
Beyond cookies, the application stores two small preferences in your browser's local storage. European regulators treat browser storage the same way as cookies, so we disclose it here.
| Key | Purpose | Type | Duration |
|---|---|---|---|
elaichi:org_id |
Remembers which organization you last had selected, so you return to the same workspace instead of being asked again on every page load. | Strictly necessary | Until you clear site data |
elaichi:onboarding_collapsed |
Remembers that you collapsed the onboarding checklist, so it stays collapsed. | Functional preference | Until you clear site data |
Both are set as a direct result of something you did in the app, are read only by the app itself, and are never used for advertising, analytics, or profiling. Neither is disclosed to any third party.
The application's session storage is empty — we store nothing there.
Cookieless technologies
| Technology | What it does | Sets a cookie? |
|---|---|---|
| Cloudflare Web Analytics | Aggregate page-view and performance measurement, served from static.cloudflareinsights.com. Cookieless by design — no identifier is stored on your device and no cross-site profile is built. We run it alongside Google Analytics. |
No |
| Cloudflare email obfuscation | Rewrites email addresses in the page to reduce scraping by spam bots. | No |
Cloudflare also operates our network and security layer. In the course of
protecting the site it may set a short-lived bot-management cookie (__cf_bm,
roughly 30 minutes) or a challenge cookie (cf_clearance) if a security
challenge is triggered. These are strictly necessary security cookies set by
our infrastructure provider and are not used for advertising or profiling.
What we do not use
- No cookies at all until you accept, beyond the two strictly necessary ones above.
- No Google Signals and so no cross-device advertising profile.
- No telemetry in the desktop app. The Elaichi desktop companion contains no analytics, crash reporting, or update pings. It talks to exactly one host: the Elaichi API URL you enter. Your API token is stored in your operating system's keychain.
Changing your choice
- Cookie settings in the site footer reopens the banner on any page. Choose "Reject all" to withdraw consent.
- Enable Global Privacy Control in your browser and we will treat it as a rejection.
- California residents: see Your Privacy Choices.
- Clear cookies in your browser settings. Note that clearing
cookie_consentmeans you will be asked again on your next visit; clearing site data forapp.elaichi.aialso clears the two local-storage preferences above, so you will be asked to pick an organization again.
Browser controls: Chrome · Firefox · Safari · Edge
Contact
Questions about this policy: [email protected]