Last updated:
1. In short
colitu.com and docs.colitu.com only use cookies needed for sign-in, security and your language choice. We do not use advertising, retargeting, social media tracking or third-party analytics cookies, and the website loads no third-party scripts. That is why we do not show a cookie consent banner.
2. Cookies we use
| Name | Purpose | Duration | Type |
|---|---|---|---|
| vostwave_web_session | Keeps you signed in to the account portal. Cannot be read by JavaScript (HttpOnly), is sent only over HTTPS (Secure) and is not sent with requests from other sites (SameSite=Strict). | Up to 24 hours | Strictly necessary |
| vostwave_csrf | Confirms that forms were submitted by you (CSRF protection). Readable by the page; Secure and SameSite=Strict. | Up to 24 hours | Strictly necessary |
| colitu_language | Remembers your language (Türkçe, English, Русский, 简体中文, فارسی); shared across colitu.com subdomains. | 1 year | Functional |
| colitu_lang_v | A marker showing that the language cookie has been moved to its current format (value "2"). | 1 year | Functional |
All cookies belong to Colitu domains only and are not shared with other sites.
3. Browser storage
Some information is kept in your browser's local storage (localStorage) instead of cookies:
| Key | Purpose |
|---|---|
| colitu_bot_visitor | A random visitor ID so you can continue a Colitu Bot chat without an account. It is sent to the server with your bot messages. |
| colitu_bot_v2 | Your recent Colitu Bot conversation (up to 60 messages) and its conversation ID; if you handed the chat to support without an account, also the ticket reference and a guest token so you can follow the reply. |
| colitu_docs_feedback_<article> | Your "Was this helpful?" answer for an article, so we don't ask again. |
| colitu-cloud-sort, colitu-cloud-mode | The sort order and view (list or grid) you chose in Colitu Space. Holds no file or vault data. |
| colitu-offer-dismissed-<code> | Remembers that you closed an offer banner. |
| colitu-signup-source (sessionStorage) | The label of the link that brought you to the site (e.g. a utm/ref tag or the name of the referring site); kept only while this tab is open, and stored on your account as the signup source if you sign up. |
These entries stay in your browser; only the visitor ID and the conversation details are sent with bot messages. Bot conversations are also stored on our side for 180 days (see the Privacy Policy).
4. Cloudflare
docs.colitu.com is served through Cloudflare. On that domain only, Cloudflare may set a strictly necessary security cookie (__cf_bm, up to 30 minutes) to tell bots from people. It is not used to build personal profiles.
5. Managing cookies
You can delete or block cookies and local storage in your browser settings. If you block the strictly necessary cookies, you won't be able to sign in to the account portal; the rest of the website keeps working. You can also clear the Colitu Bot history from your browser with the "New chat" button in the chat window.
6. Apps
The Colitu apps do not use cookies. Session tokens are kept with each platform's secure storage: encrypted with an Android Keystore key on Android, DPAPI on Windows, the Keychain on iOS, and encrypted with a key derived from the machine and user on Linux. The apps contain no analytics, advertising or crash-reporting libraries; see the Privacy Policy.
7. Contact
Questions: privacy@colitu.com. For details on how personal data is processed, read the Privacy Policy.
Questions? Write to support@colitu.com.