Cookie Notice
Version 2026-08-01 · Effective 1 August 2026
Aulay sets three cookies. All three are first-party, all three are needed for the product to work, and none of them tracks you. There is no advertising, no analytics, and no third-party cookie anywhere in Aulay.
This website sets no cookies at all. You can read every page here without one being written.
The three cookies
| Name | Purpose | Lifetime |
|---|---|---|
aul_access | Your signed-in session. Without it every page load would ask you to sign in again. | 15 minutes |
aul_refresh | Renews the session above so you are not signed out mid-task. Scoped to the single refresh endpoint and sent nowhere else. | 30 days |
aul_active_scope | Remembers which organisation you last had selected, so you land back where you left off. | 12 months |
All three are set on .aulay.io with the HttpOnly, Secure and SameSite=Lax flags. HttpOnly means no JavaScript — ours or anyone else’s — can read them, which is also why they cannot be used to build a profile of you.
Why there is no cookie banner
Consent is required for cookies that are not strictly necessary — analytics, advertising, cross-site tracking. Aulay sets none of those.
aul_accessandaul_refreshexist solely to keep you signed in to a service you asked to use. They are strictly necessary.aul_active_scopestores a preference you set yourself, after signing in, and holds nothing but the identifier of the organisation you picked.
A banner asking permission for cookies you cannot decline without losing the ability to sign in would be theatre. We would rather tell you exactly what is set and let you check it. If you would like to, open your browser’s developer tools, look at Storage, and compare it against the table above — you should find exactly three entries and nothing else.
Controlling them
You can block or delete cookies in your browser settings at any time. Blocking aul_access or aul_refresh will prevent you from signing in. Signing out clears all three.
Local storage
The application also keeps some data in your browser’s local storage — an access token and interface preferences such as your layout. This never leaves your device except as the ordinary authenticated request that a cookie would carry, and clearing site data removes it.
Questions
Write to privacy@aulay.io. If you find a cookie that is not on this list, we want to know — that would be a bug.
Previous versions of this document are available on request.