Cookie Policy

1. What cookies do

Cookies are small values stored by your browser. SHYWAI uses an essential first-party cookie to keep you signed in. It contains a random session token, not your password, report or scenario messages.

2. Our sign-in cookie

• Name: hrnw_session.
• Purpose: authenticate your requests and protect access to your account and private work.
• Lifetime: up to 604800 seconds (7.0 days) after sign-in. The server session also expires after 86400 seconds (24.0 hours) without activity, even if the browser still holds the cookie.
• Controls: the cookie is HttpOnly and SameSite=Lax. Signing out clears the cookie and revokes the session. Deleting your account revokes its sessions.

This cookie is necessary for the signed-in service you request. Blocking it prevents sign-in and private account features, but you can still read public pages.

3. Checkout and external services

When you use Stripe checkout, Stripe may use cookies and similar technologies for payment functionality, security and fraud prevention. These are described in Stripe's Cookie Policy. Stripe controls technologies on its hosted checkout.

Our pages load HTMX from unpkg.com. Your browser contacts that network to download the library. This is a resource request and is separate from our account cookie; see the Privacy Policy for data processing details.

Our pages also load a small analytics script from our own analytics server, which we run ourselves. Your browser contacts that server to download the script and to send the usage statistics described in section 4.

4. Analytics and your choices

SHYWAI measures how the site is used with Umami, an analytics tool that we run on our own server. Umami does not set cookies and does not write anything to your browser's storage by itself, so the only cookie we use is the essential sign-in cookie described above. The only value we ever store in your browser for statistics is the optional off switch described below, and only when you press its button. We do not use advertising cookies.

For each page you open, Umami receives the type of page (for example a public page or your cabinet), never an address that identifies you, your run or your public link. It also receives the site you came from, your browser and operating system, your device type, screen size and language, and an approximate location derived from your IP address (country, region and city). Umami does not store your IP address. When you take a key step, such as signing up, starting or finishing a run, publishing a page, clicking a Buy credits link or starting a checkout, it receives the name of that step, plus where the link was or which credit pack you chose, and no personal details. If the sign-up form shows an error, or your cabinet shows a scenario you do not have enough credits to start, it receives only the kind of problem (for example that an email address is already registered, or that credits are short), never what you typed. We do not measure admin pages.

This data stays on our server, is not shared with third parties and is not linked to your account. If your browser sends a Do Not Track signal, Umami sends nothing at all. You can also block the script in your browser; the service works the same without it. If we ever add optional tracking that sets cookies or stores data in your browser, we will explain it and ask for consent before it runs where consent is required.

Not every browser has a Do Not Track setting, so you can also switch usage statistics off for this browser here. The button below stores one value, named umami.disabled, in your browser's local storage. It is written only when you press the button, never automatically. While the value is there, the analytics script sends nothing from this browser. It stays until you remove it with the same button or clear this site's data in your browser. This works without signing in, but it needs your browser to let this site store data; if it does not, Do Not Track or blocking the script works instead.

You can inspect, delete or block cookies through your browser settings. Clearing your sign-in cookie signs that browser out; it does not delete your account or its stored work. To remove your account, use Delete account.

5. Changes and contact

We update this policy when the technologies we use change and show the effective date above. Questions about cookies or privacy can be sent to privacy@shywai.com.