Cookie Policy
Effective date: [effective date] · Last updated: October 6, 2026
This policy explains the cookies and similar browser storage Clevers LLC uses on HEYTOUR's website (https://heytour.ai) and web app (https://app.heytour.ai). It's part of our Privacy Policy.
In short: we use only what's strictly necessary to sign you in and keep the Service working. We don't use analytics, advertising or tracking cookies, so we don't show a cookie banner. If that ever changes, we'll update this page and ask for your consent before setting any non-essential cookie.
What cookies and browser storage are
Cookies are small files a website stores in your browser. Websites can also keep information in your browser's local storage (which stays until it's cleared) and session storage (which is cleared when you close the tab). The law treats them the same way: anything that isn't strictly necessary needs your consent.
The web app (https://app.heytour.ai)
Cookies
| Name | Set by | What it does | How long |
|---|---|---|---|
refresh_token |
api.heytour.ai | Keeps you signed in. It holds a random sign-in token that can't be read by scripts on the page (HttpOnly) and is sent only over HTTPS (Secure). | Until you sign out, or 30 days |
That's the only cookie we set. We keep your short-lived access token in memory only, never in a cookie or in storage.
Browser storage
| Name | Type | What it does | How long |
|---|---|---|---|
heytour.onboarding |
Session storage | Remembers what you typed on earlier sign-up or sign-in steps (your name and email or phone) | Until you close the tab |
| Invitation and next-step details | Session storage | Remembers the invitation you're accepting, or what you were doing, while you sign in | Until you close the tab |
| Single sign-on state | Session storage | A one-time security value (PKCE) used to finish signing in through your organization's identity provider | Until you close the tab, or the sign-in finishes |
| Reload marker | Session storage | Stops the page reloading in a loop after we release a new version | Until you close the tab |
heytour.phoneCountry |
Local storage | Remembers the country you last chose for your phone number | Until you clear it |
All of these are strictly necessary for something you asked for, or a small convenience that never leaves your browser, so they don't need consent.
Content from other companies
- Sign in with Apple: if the Apple button is shown, the web app loads Apple's sign-in script from Apple. Apple may set its own cookies when you use the button to sign in. See Apple's privacy policy.
- Sign in with Google or Microsoft, and your organization's single sign-on: when you choose one of them, you go to that provider's site, which uses its own cookies under its own policy.
The website (https://heytour.ai)
The website sets no cookies and uses no browser storage, analytics or advertising tools. Its font is served from our own site, not from Google. Our hosting provider (Google Firebase Hosting) receives your IP address and browser details to deliver the pages and keep the site secure, as any web server does.
The mobile apps
The mobile apps don't use cookies. They store your sign-in tokens in your device's secure storage, and a few preferences on your device. See the Privacy Policy for the device information they send us.
Your choices
You can block or delete cookies and site data in your browser's settings. If you block the refresh_token cookie, you'll need to sign in again each time you open the web app.
Changes and contact
If we change what we use, we'll update this page and the date at the top. Questions: privacy@heytour.ai.