Cookie Policy

Canopy AI keeps cookies and browser storage to the minimum needed to run the Service securely, plus optional analytics cookies on our public website that only run if you agree to them. We do not use advertising cookies, we do not track you across other websites, and we do not sell data collected through cookies.

The analytics cookies described here never run inside the platform. When you are signed in at app.thecanopyhub.com, no analytics or advertising scripts run and no cookies are set beyond the ones needed to keep you signed in. The platform does use Sentry to detect faults, and loads its typeface from Google Fonts. Neither sets a cookie, and neither receives your contract, shipment or document data.

These are required for the Service to work and cannot be switched off through the platform:

• tp_refresh: a secure, httpOnly cookie that keeps you signed in and lets your session be renewed safely. It is scoped to the authentication endpoints, is not readable by page scripts, and expires after 7 days.
• tp_device: an httpOnly cookie, sent over secure connections only, set on this browser when you sign in or complete a password reset. If someone repeatedly tries wrong passwords for your account, sign-in attempts from browsers without this cookie are paused for a while, while this browser can usually still sign in. It holds a random value, a code derived from your email address with a secret key (never the address itself) and a signature. It stops counting once your password is changed or reset elsewhere. It does not sign you in, is sent only with sign-in requests, is used for nothing else, stays after you sign out, and expires after 90 days.

On our public website only, we use Google Analytics to count visits and see which pages are read, so we can tell whether the site is useful. These cookies are set only after you accept them. If you decline, or simply ignore the banner, none of them are set and nothing is sent to Google.

• _ga: distinguishes one visitor from another. Expires after 2 years.
• _ga_<identifier>: keeps the state of your visit. Expires after 2 years.

The information collected is limited to standard website measurement: the pages viewed, approximate location, and the browser and device type. Your IP address is sent to Google to derive that approximate location; Google discards it rather than storing it against your visit. Only the public pages of this website are ever reported, never any address inside the platform. It is never combined with your account, and no contract, shipment or document data is involved.

In addition to the cookies above, we use your browser's local storage for:

• tp_user: your account identifier, email address and role, so the interface can render immediately when you return. The short-lived access token that authorises your requests is held in memory only and is never written to disk.
• Interface preferences: small settings such as the width you gave the assistant panel, so the interface behaves the way you expect.
• tp_cookie_consent: whether you accepted or declined analytics cookies, so we do not ask again on every visit. We record this in local storage rather than in a cookie, so declining does not itself set one.

We also use session storage, which your browser discards when you close the tab, to keep your conversation with the in-product assistant across a page reload. That conversation can contain text you have typed and values read from your shipment documents.

You can also clear or block cookies and local storage through your browser settings. Because the authentication cookie is strictly necessary, blocking it will prevent you from signing in and using the Service.

For how we handle personal data more broadly, see our Privacy Policy. Questions can be sent to info@ioto.team.