Effective May 2, 2026 · Updated October 2, 2026
Cookie Policy
1. What Cookies and Similar Technologies Are
Cookies are small files stored on your device. Similar technologies include pixels, SDKs, local storage, session storage, tags, beacons, embedded content, scripts, and other tools that store information on, or access information from, your browser or device.
2. Why We Use These Technologies
Acubic uses strictly necessary technologies to provide login, guest-session quotas, security, billing, support, and portfolio-builder workflows.
With your permission, we also use analytics and advertising technologies:
- Analytics: PostHog product analytics, including session replay with form inputs masked, and Google Analytics.
- Advertising measurement: the Reddit pixel, the OpenAI (ChatGPT) Ads pixel, and the Google Ads tag, which tell us which ads lead to visits, sign-ups, and subscriptions.
These load only through our consent manager. In the EU/EEA, the UK, and where we cannot determine your region, they stay off until you opt in. In the United States, analytics is on by default and you can turn it off, and advertising technologies stop when you opt out of sale/sharing or your browser sends a Global Privacy Control signal. Google's tag loads on every page with Google Consent Mode defaults set to "denied": until your choices allow it, it sets no analytics or advertising cookies and sends only cookieless pings.
We also set a few first-party cookies of our own that remember how you arrived: acubic_utm (campaign tags and ad click IDs, kept 90 days, used to record where a new account came from), and, only when you follow a creator referral or partner link, acubic_ref, acubic_vid, and acubic_partner. These are listed in the inventory below.
3. Cookie Categories
- Strictly necessary: required for the website, account, security, payment, and requested app workflows.
- Functional: optional interface preferences, such as remembering UI state.
- Analytics/performance: non-essential measurement beyond necessary operational logs.
- Personalization: optional tailoring based on prior behavior.
- Advertising/targeting: retargeting, cross-context behavioral advertising, pixels, and ad measurement.
- Social media/embedded content: third-party embeds that may set their own tracking technologies.
- Security/fraud prevention: bot detection, abuse prevention, account protection, and payment security.
4. Detailed Inventory
| Name | Provider | Party | Category | Purpose | Data collected | Expiration | Region behavior | Consent required | Sale/share/targeted ads | Policy |
|---|---|---|---|---|---|---|---|---|---|---|
| refresh_token | Acubic | first-party | Strictly necessary | Maintains authenticated sessions and supports token refresh. | Opaque refresh token stored as an HttpOnly cookie; related server logs may include IP address and user agent for security. | Up to 7 days, based on REFRESH_TOKEN_EXPIRE_DAYS. | Allowed in all regions as strictly necessary for account login. | No, strictly necessary. | No. | View |
| acm_guest_sid | Acubic | first-party | Strictly necessary | Maintains guest portfolio-generation quota and transfers guest usage to an account after sign-in. | Opaque guest session token; server stores a token hash, IP address, user agent, creation time, and last-seen time. | Up to 30 days, based on GUEST_SESSION_EXPIRE_DAYS. | Allowed in all regions as service, abuse-prevention, and quota functionality. | No, treated as strictly necessary/security. | No. | View |
| sidebar:state | Acubic UI | first-party | Functional | Remembers whether an application sidebar is open or collapsed. | Boolean UI preference only. | 7 days. | EU/EEA/UK/unknown: load only after functional consent. US: user may opt out in Cookie Settings. | Yes in opt-in regions unless strictly necessary for a requested UI action; currently documented as functional. | No. | View |
| acm_cookie_consent | Acubic | first-party | Strictly necessary | Stores cookie and privacy choices, region mode, GPC status, timestamps, and policy/schema versions. | Consent ID, categories selected, region classification, GPC flag, source, and timestamps. No portfolio or payment data. | 180 days, or until policy/vendor/schema changes require a new choice. | Allowed in all regions to remember legally required privacy choices. | No, necessary to remember consent/opt-out choices. | No. | View |
| acm_is_authenticated / acm_user | Acubic | first-party | Strictly necessary | Keeps the logged-in UI state responsive after refresh. Access tokens remain in memory; the refresh token is in an HttpOnly cookie. | Minimal account display state in localStorage. | Until logout, browser clearing, or local app cleanup. | Allowed in all regions for authenticated account functionality. | No, tied to account service requested by the user. | No. | View |
| acm_profile_avatar_<user> / acm_portfolio_live_state | Acubic | first-party | Strictly necessary | Stores a user-keyed profile image preference and a local cache of portfolio live-mode display state. | Uploaded profile image data and portfolio display settings; no broker credentials or access tokens. | Avatar until browser clearing; portfolio state until logout, account change, or browser clearing. | Allowed in all regions for account and portfolio functionality requested by the user. | No, tied to account service requested by the user. | No. | View |
| acubic.lang / acubic.lang.preview | Acubic | first-party | Strictly necessary | Remembers the display language you pick in the language selector (acubic.lang, localStorage). acubic.lang.preview (sessionStorage) is used only on internal preview builds for translation review. | A language code such as "de" or "it". No personal data. | acubic.lang until you change it or clear browser data; acubic.lang.preview when the tab closes. | Allowed in all regions, written only when you choose a language yourself. The site never sets it from your browser language. | No, it stores a setting you explicitly requested. | No. | View |
| workflow/session keys | Acubic | first-party | Strictly necessary | Preserves portfolio-builder workflow state, optimization results, rate-limit UI state, and post-auth redirects during a browsing session. | Portfolio workflow inputs/results that the user entered or generated in the app. | Until logout, account change, explicit workflow cleanup, or the tab/browser session ends. | Allowed in all regions for requested portfolio-builder functionality. | No, required to provide requested app workflows. | No. | View |
| acubic_utm | Acubic | first-party | Other | Marketing attribution: remembers how you reached us so it can be recorded on your account if you sign up. | Campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), ad click identifiers (gclid, rdt_cid), the referring site, the landing page, and a label (ai_engine) when you arrive from an AI assistant such as ChatGPT. Read only by Acubic; ad click identifiers are passed to an ad platform only within your advertising choices. | 90 days. | Set in all regions on your visits to the site, recording the referring site and any campaign tags or ad click identifier on the link you used. | Not currently requested: this first-party cookie is set without a consent prompt and is disclosed here. | No by itself; see the advertising entries below for what is shared with ad platforms. | View |
| acubic_ref / acubic_vid | Acubic | first-party | Other | Referral program: acubic_ref remembers which creator's referral link you followed so the creator can be credited if you subscribe; acubic_vid is a random visitor ID used to count repeat visits from the same browser only once. | The creator's referral code and a random identifier. HttpOnly; not readable by scripts. | 90 days. | Set in all regions, only when you open a creator referral link (acubic.ai/r/...). | Not currently requested: set when you follow a referral link, and disclosed here. | No. | View |
| acubic_partner | Acubic | first-party | Strictly necessary | Applies a partner offer (for example, the eToro partner month) when you arrive through a verified partner link and then sign up. | A signed token naming the partner and placement. HttpOnly; no personal data. | 30 days. | Set in all regions, only when you open a verified partner link. | No, needed to provide the offer you followed the link for. | No. | View |
| acubic_event / acubic_event_screen | Acubic | first-party | Strictly necessary | Keeps a shared screen at an in-person event in event mode and lets it hand sign-in over to your own phone. | A signed event token and a random screen identifier. HttpOnly; no personal data. | Up to 12 hours. | Set only on screens opened through an Acubic event link. | No, needed for the event flow. | No. | View |
| Cloudflare Turnstile scripts and tokens | Cloudflare | third-party | Security/fraud prevention | Bot detection on login/signup when Turnstile is enabled. | Challenge token, IP address sent server-side for verification when enabled, device/browser signals processed by Cloudflare. | Controlled by Cloudflare and challenge lifecycle. | Allowed where enabled as security/fraud prevention. Disclose as third-party security technology. | No when used only for security and fraud prevention; legal review should confirm deployment mode. | No, if configured only for security. | View |
| Stripe Checkout/Billing Portal cookies | Stripe | third-party | Strictly necessary | Processes subscriptions, checkout, fraud prevention, and customer portal sessions after a user chooses billing actions. | Billing customer identifiers, email, payment metadata, fraud-prevention and transaction data handled by Stripe. | Controlled by Stripe on Stripe-hosted pages. | Allowed when the user initiates payment or billing management. | No for payment/security functionality requested by the user. | No, based on current implementation. | View |
| Google OAuth/OIDC cookies | third-party | Strictly necessary | Authenticates users who choose Google sign-in or account linking. | OAuth authorization data and Google account profile claims returned after user authorization. | Controlled by Google on Google-hosted authentication pages. | Allowed only when the user initiates Google authentication. | No for user-requested authentication. | No, based on current implementation; legal review should validate Google configuration. | View | |
| _ga, _ga_FX3545FWC6 | Google Analytics | third-party | Analytics/performance | Web analytics: counts visits and measures how people use the site (Google Analytics property G-FX3545FWC6). | A pseudonymous client ID, pages viewed, events, approximate location, and browser/device details processed by Google. | Up to 2 years. | Google's tag loads on every page with Google Consent Mode defaults set to denied, so until your choices allow analytics it sets no cookies and sends only cookieless pings. EU/EEA/UK/unknown: cookies only after analytics consent. US: on by default; stops when you opt out of analytics in Cookie Settings. | Yes, analytics category. | No. | View |
| Google Ads tag (AW-18082533203): _gcl_au and conversion-linker cookies | Google Ads | third-party | Advertising/targeting | Measures which Google ad clicks lead to sign-ups and subscriptions. When advertising storage is denied, the ad click ID (gclid) can be carried in page addresses instead of cookies (URL passthrough). | Ad click identifier (gclid), conversion events, and browser/device signals processed by Google. | Up to 90 days. | Loads with Google Consent Mode defaults set to denied. EU/EEA/UK/unknown: advertising storage only after advertising consent. US: on by default; turned off by a sale/share opt-out or GPC. | Yes, advertising category. | Yes. | View |
| Reddit pixel: _rdt_uuid | third-party | Advertising/targeting | Measures visits and trial starts from Reddit ads (pixel a2_jkhzqotdblvv). | A pseudonymous browser identifier, page visits, conversion events, our opaque account ID when you are signed in, and browser/device signals processed by Reddit. | Up to 90 days. | EU/EEA/UK/unknown: load only after advertising consent. US: suppressed by a sale/share or targeted-advertising opt-out, or GPC, even when the advertising category is on. | Yes, advertising category. | Yes. | View | |
| OpenAI (ChatGPT) Ads pixel | OpenAI | third-party | Advertising/targeting | Measures conversions from ChatGPT ads and supports ad targeting/attribution. | Browser/device signals and pixel identifiers processed by OpenAI for ad measurement. | Controlled by OpenAI. | EU/EEA/UK/unknown: load only after advertising consent. US: suppressed by a sale/share or targeted-advertising opt-out, or GPC, even when the advertising category is on. | Yes, advertising category. | Yes. | View |
| ph_<project key>_posthog (cookie and localStorage) | PostHog | third-party | Analytics/performance | Product and web analytics and session replay: which pages and features are used, and where visitors get stuck. | Pseudonymous device and session identifiers, pages viewed, clicks, browser/device details, and session recordings with every form input masked, and all on-screen text masked for signed-in users (so no holdings, balances or broker figures are recorded). One-time tokens and codes in page addresses (password reset, email verification, sign-in callbacks) are masked before they leave the browser. Signed-in users are linked by their opaque Acubic user ID only, never email or name. | 1 year for the persistence entry; cleared on sign-out. | EU/EEA/UK/unknown: load only after analytics consent. US: loaded by default; stops as soon as the visitor opts out of analytics in Cookie Settings. | Yes, analytics category. | No. | View |
| Admin/usage analytics events | Acubic | first-party | Strictly necessary | Tracks account, billing, quota, support, security, and operational events in the backend for service administration. | Authenticated user ID or guest session ID, event type, source endpoint, timestamps, and limited event payloads. | Kept on our servers with no fixed deletion date; the link to your account is removed when you delete your account. | Allowed when necessary for service operation, security, billing, quota enforcement, and support. | No for necessary operational and security logs. | No. | View |
5. Managing or Withdrawing Consent
You can open Cookie Settings from the footer at any time. In EU/EEA, UK, and unknown-region mode, non-essential technologies are off unless you opt in. “Reject all” and “Accept all” are presented with comparable access, and choices are granular by category. You can withdraw consent as easily as you gave it.
You can also use browser settings to block or delete cookies. Browser-level blocking may affect login, security, billing, guest quotas, and portfolio workflows that depend on strictly necessary cookies or session storage.
6. Regional Rights and GPC
EU/EEA and UK users have consent rights for non-essential storage/access technologies. California and other covered US state users may have rights to opt out of sale, sharing, targeted advertising, and certain sensitive-data uses. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sale/sharing and targeted advertising for applicable US jurisdictions and block those categories.
7. Policy Versions and Changes
Current versions: Cookie Policy 2026-05-02, Privacy Policy 2026-05-02, Terms 2026-05-02, Consent Schema 1.0.0. We will re-prompt when policy versions, vendors, purposes, or cookie categories materially change.
8. Contact
For privacy requests or questions, contact privacy@acubic.ai.