Version v3 | Effective 27 October 2026 | Part Central Limited, trading as Cady (Company 15296116, England and Wales)
What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They help the site function correctly, remember your preferences, and understand how you use the site.
Cookies We Use
The app uses the cookies listed below for sign-in and security. Cookie names begin with the name of the Cady server that issued them; the names below are those used at app.cadyworks.com. We do not intentionally use advertising, analytics or tracking cookies. Our public website does not intentionally set application or analytics cookies. The app cookies below are used at app.cadyworks.com. Cloudflare security behaviour is addressed separately below.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| __Secure-cady-app.session_token | Keeps you signed in to the Cady app, whichever way you sign in | Strictly necessary | Up to 30 days when you sign in with a passkey or a Google, Microsoft or GitHub account, or with a password and “Remember me” ticked, renewed at most once a day while you use Cady. Otherwise until you close your browser (and no longer than 24 hours) |
| __Secure-cady-app.session_data | Holds a short-lived copy of your session details so the app does not look them up on every request | Strictly necessary | 5 minutes |
| __Secure-cady-app.dont_remember | Records that you signed in with a password without ticking “Remember me”, so your sign-in ends when you close your browser. Set only in that case | Strictly necessary | Until you close your browser |
| __Secure-cady-app.oauth_state | Protects the sign-in handshake when you sign in with Google, Microsoft or GitHub | Strictly necessary | 10 minutes |
| __Secure-cady-app.better-auth-passkey | Holds a one-time security challenge while you register or use a passkey | Strictly necessary | 5 minutes |
| __Secure-cady-app-us-bounce | Stops your browser looping between our EU and US servers when a sign-in is needed | Strictly necessary | 5 minutes |
| __Secure-cady-guest | Keeps a dataroom guest signed in to one shared room after they verify their email address with a code. Used only on dataroom guest pages. | Strictly necessary | Up to 8 hours, or until the guest signs out or the share changes |
| __Host-cady-signup-focus | Remembers the starting focus you chose on the sign-up page, so the company you create is set up for it | Strictly necessary | 7 days |
| __Host-cady-connect-establish-error | Remembers that connecting an agent to a company failed, so the next page can explain what happened | Strictly necessary | 10 minutes |
Third-Party Cookies
When you connect your AI agent (such as ChatGPT or Claude) to Cady, you sign in and approve the connection on Cady’s own pages. Your agent provider may set its own cookies on its own website; those are governed by that provider’s cookie policy, not ours. Cady does not control or have access to third-party cookies.
Cloudflare Turnstile (our bot protection service) runs only on the company sign-up page and the dataroom code request page. It may set cookies to distinguish legitimate users from automated traffic. We use it only to protect those pages from abuse, and treat it as strictly necessary for that purpose.
Local Storage
The Cady app keeps a few small values in your browser’s local storage: the email address you entered, only when you tick “Remember me” (it is not ticked by default; on a device that has remembered your email, the box is ticked again on your next visit, and unticking it clears the email), so you do not need to type it again; the company you last chose when connecting an agent; and a note that this device has a passkey, so the app can offer it. They stay until you untick “Remember me” or clear your browser storage. They are not used for advertising or analytics.
While you create a company, the sign-up page keeps a temporary record of the pending request (the company name you entered, a request identifier and a reference to your current sign-in) in your browser’s session storage, so the request can be retried safely if the page reloads. It is removed when the step completes and is cleared when you close the tab. When you accept the terms while signing up, session storage also holds a short note of that acceptance for up to 10 minutes, until your account records it. If you start connecting an agent and your sign-in link expires, session storage keeps the name of that agent (for example ChatGPT or Claude Code) so the next page can tell you how to return to it; it is removed as soon as that page reads it, and cleared when you close the tab.
Session storage holds the temporary retry state in your browser. When you submit or retry the request, the relevant company name and request identifier are sent to Cady. Keeping a local copy does not mean those values are never transmitted.
Your Rights
We rely on the applicable strictly necessary exemption for storage or device access needed to provide the service you request or protect it. Any optional storage or device access requiring consent will remain off until that consent is obtained. You can manage cookies through your browser settings:
- Block or delete cookies via your browser's privacy settings
- Use your browser's "incognito" or "private" mode
Please note that blocking strictly necessary cookies will prevent Cady from functioning correctly (e.g., you will not be able to stay signed in).
Changes to This Policy
If we introduce non-essential cookies in the future, we will update this policy and implement a consent mechanism before deploying them.
Contact
For questions about our use of cookies, contact data@cadyworks.com.