Cookie Policy

These are set without asking, because the service, or a step you started, needs them. None of them is used for advertising. All are first-party: they belong to autotender.ai.

• Sign-in session (cookie named sb-, then our project reference, then -auth-token; split into numbered parts ending .0, .1 when it is large): keeps you signed in. Set when you sign in and cleared when you sign out; your browser keeps it for up to 400 days. SameSite=Lax. It is not httpOnly, because our sign-in library has to read it from the page to keep you signed in. It holds your sign-in tokens and the account details they carry, such as your user ID and email address. If you use the Chrome extension, the extension checks for this cookie and, when you are signed in on the website, signs itself in with a session of its own.
• Sign-in verifier (cookie named like the session cookie, ending -code-verifier): set while a sign-up, a Google or Microsoft sign-in or a password reset is in progress, and removed when that step completes. Same settings as the session cookie.
• Referral code (cookie at_ref): set only when you open AutoTender through a referral link. It holds the referral code so that the discount reaches your account even if you sign up with Google or Microsoft or confirm your email on another device. Kept for up to 30 days, httpOnly (the page's scripts cannot read it), SameSite=Lax, sent only over HTTPS. A later link does not replace it, and it is deleted when you finish onboarding.
• Email link (cookie at_acq): set only when you open AutoTender through a link in one of our business emails. It holds the link's campaign tags, our reference for your company's record, the tender the email was about and, for a US company, its SAM.gov Unique Entity ID, so that we know which email brought you and can open that tender for you after sign-up. Same settings, lifetime and deletion as at_ref.
• Welcome tour (cookie at_tour_dismissed): remembers that you closed the welcome tour on your dashboard. It holds the value 1 and no personal data. Kept for a year; readable by the page's scripts; SameSite=Lax. Replay onboarding tour in Help deletes it.
• Menu layout (cookie at_nav_collapsed): remembers which groups of the dashboard menu you collapsed. It holds only those choices. Kept for a year; readable by the page's scripts; SameSite=Lax.

We also keep a few items in your browser's storage. These are not cookies: your browser does not send them to us with each request. Local storage stays until you clear it; session storage ends when you close the tab.

• autotender_cookie_consent (local storage): your cookie choice, so that the banner does not reappear on every visit.
• at_push_prompt_shown_at (local storage): when we last offered browser notifications, so that we offer them again only after 30 days.
• autotender_extension_prompt_dismissed (local storage): that you hid the prompt to download the Chrome extension.
• at_referral_prompt (local storage): when we last suggested the referral programme after you finished a step, how many times you closed that suggestion, and whether you asked not to see it again, so that we suggest it at most once every 14 days and stop when you ask. It holds no personal data.
• at_onboarding_step and at_onboarding_draft, each followed by your user ID (local storage): the onboarding step you reached and a draft of what you have typed during onboarding (company details, projects, team members, certifications and pricing), so that you can carry on where you left off on this device. Both are deleted when you finish onboarding.
• at_teaming_invite (local storage): the teaming invitation you signed up through, with the time, so that onboarding can complete it; removed once onboarding has used it.
• at_user_persona (session storage): whether you signed up as an SME owner or a bid writer, so that the onboarding steps are worded for you.
• at_email_confirm (session storage): that we sent your confirmation email, so that the sign-up page still says so if you reload it.
• at_subscribe_sent, followed by the plan and billing period (session storage): that we already opened secure checkout for that plan in this tab, so that pressing Back from the payment page does not open it again.
• at_bids_list_query (session storage): the filters of your proposals list, so that the Proposals link on a proposal takes you back to the same list.
• Cache storage (caches whose names begin with autotender-): only if you turn on push notifications, our service worker keeps copies of the homepage, the offline page and files such as images, fonts and the site's code, so that pages load faster and the offline page can be shown. It never keeps signed-in pages or your data. Signing out deletes them.
• admin_tour_complete, admin_pinned_pages and admin_recent_pages (local storage): used only in the browsers of AutoTender's own administrators, for the admin panel.