Last updated: 1 September 2026
This page lists what this site stores on your device, who sets it, why, and for how long. Cookies that are not strictly necessary are used only after you agree to them. If you refuse, they are not set — the analytics tag is not loaded at all, rather than loaded in a restricted mode.
You can change your decision at any time, and withdrawing consent is as easy as giving it. Your browser settings are an additional control, not a substitute for this one.
These are required for the site to work at all: signing in, keeping a session, protecting forms, and remembering the cookie choice you made. They are exempt from the consent requirement because the service you asked for cannot be delivered without them.
| Name | Set by | Lifetime | Purpose |
|---|---|---|---|
| next-auth.session-token | NextAuth (first party) | 30 days | Keeps you signed in to the portal. httpOnly, sameSite=lax. |
| next-auth.csrf-token | NextAuth (first party) | Session | Protects authentication endpoints against cross-site request forgery. |
| next-auth.callback-url | NextAuth (first party) | Session | Remembers where to return after signing in. |
| next-auth.pkce.code_verifier | NextAuth (first party) | 15 minutes | PKCE verifier used during sign-in with an external provider. |
| next-auth.state | NextAuth (first party) | 15 minutes | OAuth state parameter; protects against replay during sign-in. |
| sophona_inv | Sophona (first party) | 6 hours | Marks the investor area as unlocked. httpOnly; secure in production. |
| sso_starter_sophona | Sophona (first party) | 24 hours | Signed token that hands a starter session to the platform. httpOnly; secure in production. |
| NEXT_LOCALE | Sophona (first party) | Session | Remembers the language you chose. Stores only your own explicit choice. |
| sophona_cookie_consent | Sophona (first party, localStorage) | Until cleared | Records this very decision, so we do not ask again on every page. |
These are not set unless you accept them. If you refuse, the Google Analytics tag is not loaded at all — it is not merely switched to a restricted mode.
| Name | Set by | Lifetime | Purpose |
|---|---|---|---|
| _ga | Google Analytics 4 (third party — Google Ireland Limited) | 2 years | Distinguishes one visitor from another. Browsers may shorten this: Chrome caps script-set cookies at 400 days, Safari at 7 days. |
| _ga_DPR5X5PPFW | Google Analytics 4 (third party — Google Ireland Limited) | 2 years | Keeps session state for this specific measurement property. |
These do not appear on an ordinary page view. They are set when you reach the flow named, and not before.
| Name | Set by | Appears when | Purpose |
|---|---|---|---|
| __stripe_mid | Stripe (js.stripe.com) | Checkout or the billing portal · 1 year | Fraud prevention and transaction risk scoring. Listed as necessary within the payment you deliberately started. |
| __stripe_sid | Stripe (js.stripe.com) | Checkout or the billing portal · 30 minutes | As above, for the current session. |
| g_state | Google Identity Services | Google sign-in pages | Remembers sign-out state for Google One Tap. Set only if you choose to sign in with Google. |
| g_csrf_token | Google Identity Services | Sign-in callback | Double-submit token protecting the sign-in callback. Necessary within the active sign-in flow. |
The law here covers storing information on your device, whatever the mechanism. The following entries are kept in localStorage, sessionStorage or IndexedDB rather than in cookies, and are listed for the same reason. Everything below stays on your own device; clearing your browser data for this site removes all of it.
| Key | Stored by | Lifetime | Purpose |
|---|---|---|---|
| theme | Sophona (localStorage) | Until cleared | Remembers your light or dark preference. |
| ms_code_verifier | Sophona (sessionStorage) | Tab session | PKCE verifier for connecting a Microsoft account. |
| sophona-chat | Embedded chat widget (IndexedDB) | Until cleared | Conversation history kept on your own device, up to 300 messages per Operator, so a conversation survives a page reload. |
| sophona_show_prev_history | Embedded chat widget (localStorage) | Until cleared | Whether earlier conversation history is expanded. |
| Widget open state | Embedded chat widget (localStorage) | Until cleared | Whether the chat bubble was left open. |
A third party does not need a cookie to learn your IP address — a request from your browser is enough, and an IP address is personal data. These connections are listed even where they store nothing.
| Destination | When | What it is |
|---|---|---|
| www.googletagmanager.com | Only after you accept statistics cookies | Loads the Google Analytics 4 tag. |
| fonts.googleapis.com, fonts.gstatic.com | Every page load | Web fonts served by Google. |
| robotforce1.sophona.app | Every page load | The chat widget's own backend; a live connection is opened to it. |
| js.stripe.com | Checkout and billing | Stripe's payment library. |
| accounts.google.com | Sign-in pages | Google Identity Services. |
| www.youtube-nocookie.com | Only after you play an embedded video | YouTube in its no-cookie mode. |
This inventory is revised whenever what the site stores changes. It was compiled from the source of this website; third-party lifetimes are taken from each vendor's own documentation and may be shortened by your browser.