What Itya stores in your browser
This policy is published by Trovakap Private Limited, which operates Itya. Itya sets 11 browser entries in total: 5 strictly necessary and 6 that remember a preference. There is no advertising cookie, no cross‑site tracking cookie, and no third-party analytics or session-recording script on any Itya page.
| Name | Purpose | Duration |
|---|---|---|
| Strictly necessary 5 | ||
__Host-refreshCookie | Holds the session refresh token so a signed-in member stays signed in. HttpOnly, Secure, SameSite, and scoped to this origin only. | 7 days, rotated on every refresh |
__Host-csrfCookie | Cross-site request forgery token bound to the session. | 7 days, rotated with the refresh token |
__Host-oauth-txCookie | Binds one in-flight OAuth sign-in or integration-connect round trip to the browser that started it. | Minutes — cleared when the OAuth round trip finishes |
itya_csrf_tokenLocal storage | Mirror of the CSRF token, used when the web app and API are served from different origins and the cookie cannot be read from script. | Until you sign out or clear site data |
itya_session_hintCookie | A flag saying “this browser probably has a session,” so the app can send you to your workspace and attempt a silent refresh instead of bouncing you to sign-in. Holds no credential. Kept as a cookie on this origin and mirrored in local storage. | 7 days, refreshed on every sign‑in or token refresh; cleared when you sign out |
| Preference 6 | ||
itya_localeCookie | Remembers the language you picked so pages render in it. | 1 year |
sidebar_stateCookie | Remembers whether the workspace sidebar is expanded or collapsed. | 7 days |
itya_themeLocal storage | Remembers your light or dark appearance choice. | Until you clear site data |
itya:job-brief-draft:v1Local storage | Keeps an unsent job-brief draft so a reload does not lose your work. | Until the draft is submitted or you clear site data |
itya_cookie_noticeLocal storage | Records that you dismissed the cookie notice on the public site so it stays dismissed. | Until you clear site data |
itya_pricing_currencyLocal storage | Remembers the currency you picked on the pricing page, US dollars or Indian rupees. Written only when you pick one. | Until you clear site data |
The public marketing, legal, pricing, support and status pages set nothing at all until you interact with them. Signing in is what creates the session cookies; changing language, theme or the sidebar is what creates the preference entries.
Why we do not ask for consent
Under the ePrivacy rules, consent is needed for storage that is not strictly necessary for a service the user has actively requested. Itya only stores two kinds of thing:
- Strictly necessary. Authentication, cross-site request forgery protection, and binding one OAuth round trip to the browser that started it. Without these you cannot sign in, and the service cannot be delivered securely. These are exempt from consent.
- Preferences you set on purpose. Language, light or dark appearance, sidebar state, an unsent draft, and the fact that you dismissed the cookie notice. Each one is written only because you performed the action that asks for it to be remembered, and each is exempt on the same basis.
Because nothing here is used for advertising, profiling or cross-context behavioral tracking, Itya does not show a consent wall with toggles that would not change anything. We show a short notice with a link to this page instead. If that ever stops being true, this page and the notice change first.
Your controls
- Clearing site data in your browser removes every entry in the table above. The next page load starts from defaults, and you will be asked to sign in again.
- Blocking cookies for this site will stop you from signing in. The public pages will still work.
- Signing out clears the session cookies immediately from both your browser and our server, and revokes the session.
- Every stored preference is per-browser and per-device. Nothing in the table is shared with a third party.
Changes and contact
If we add browser storage that is not strictly necessary or a straightforward preference, we will update this page before it ships and put a real consent choice in front of you.
The privacy policy covers everything else we process, and the subprocessor list names every third party involved. Questions go to security@itya.ai.