Cookie policy
Last updated November 6, 2026
The short version
- Our public marketing website sets no cookies at all.
- Our web application and Trust Center pages use only a handful of strictly necessary cookies required to keep you signed in and protect security.
- We do not use analytics, advertising, or cross-site tracking cookies, so there are no non-essential cookies to consent to or opt out of.
Non-binding summary: This summary is provided solely for convenience to help you navigate this document. It is not legally binding; the full text below explains our use of cookies and local storage.
1. What cookies and local storage are
Cookies are small text files placed on your device by a web server when you visit a website or web application. Browser local storage and extension storage are similar mechanisms that allow an application to store small pieces of state locally in your browser. Under laws such as the EU ePrivacy Directive, the UK PECR, and the GDPR, cookies and local storage that are strictly necessary to provide a service explicitly requested by the user (such as authentication and security) do not require prior opt-in consent. This Cookie Policy covers both cookies and local storage used by AcuityRFP.
2. Our marketing website
Our public marketing website (acuityrfp.com) sets zero cookies and uses no third-party analytics, behavioral tracking pixels, or advertising scripts. Our hosting provider records standard, transient HTTP server logs (IP address, user-agent, and request timestamp) strictly for network security and reliability, as explained in our Privacy Policy.
3. The AcuityRFP application and Trust Center
When you sign in to the AcuityRFP web application or verify your email on a customer’s hosted Trust Center, we set only the following strictly necessary first-party cookies. Because authentication and security cannot function without them, they cannot be switched off within the application.
| Cookie Name | Scope | Purpose | Duration |
|---|---|---|---|
__Host-acuity-session (may be split into numbered parts such as .0, .1) | Web Application | Authenticates your active User session and allows the server to verify your identity and organization permissions on each request. Configured as HttpOnly (readable only by the server) and Secure, and bound to the application’s own domain. | Ends after 24 hours without use, and in any case 14 days after you sign in; also ended when you sign out or change your password |
__Host-acuity-device | Web Application | A random identifier that tells a browser you have used before from a new one, so we can email you about a sign-in from a new browser. It grants no access. Configured as HttpOnly (readable only by the server) and Secure. | One year |
trust_session_<organization> | Hosted Trust Center pages | Remembers that an external visitor has verified their email address to view a specific organization’s Trust Center. Configured as HttpOnly (readable only by the server) and scoped strictly to that Trust Center’s path. | Matches the organization’s configured Trust Center access period: 7, 30, or 90 days |
google_oauth_nonce, microsoft_oauth_nonce, slack_oauth_nonce | Web Application (Admin OAuth flow) | Cryptographic anti-forgery (CSRF) tokens set temporarily when an organization admin initiates an OAuth connection to Google Drive, SharePoint/OneDrive, or Slack, binding the authorization flow to their browser. | 10 minutes |
4. Browser local storage and extension storage
We also use local browser storage strictly to support user-requested interface state and extension authentication:
- Web Application Local Storage: Remembers your UI preference for whether the navigation sidebar is collapsed and stores your recent in-app search queries locally in your browser for your convenience. This data never leaves your browser for tracking purposes.
- Browser Extension Storage: When you install and sign in to the AcuityRFP Chrome/Edge extension, your authentication session is kept inside the browser’s isolated
chrome.storagecontainer (which web pages cannot access), along with a short-lived reference to the form field you right-clicked when inserting an answer.
5. Third-party domains
- OAuth Identity Providers: When an admin connects Google Drive, Microsoft SharePoint/OneDrive, or Slack—or when a User signs in via SAML Single Sign-On—authentication takes place directly on that third-party provider’s own domain, which is governed by that provider’s cookie policy.
- Bot Check on Sign-Up: The sign-up page loads a check from a security provider, which receives your IP address and browser signals to tell people from bots, under that provider’s own policies.
- Stripe Checkout and Billing Portal: Subscription checkout and billing management pages are hosted by Stripe on Stripe’s domain to ensure PCI-DSS security and fraud prevention, governed by Stripe’s Cookie Policy.
6. Managing or deleting cookies in your browser
You can inspect, delete, or block cookies and local storage at any time through your browser’s privacy or site-data settings. Please note that blocking the strictly necessary cookies listed above will prevent you from signing in to the AcuityRFP application, connecting OAuth integrations, or maintaining verified access to a Trust Center.
7. Updates to this policy
If we ever introduce any non-essential cookies (such as optional analytics cookies) in the future, we will update this Cookie Policy in advance and implement an opt-in consent mechanism where required by applicable law. If you have any questions about our use of cookies, please contact us at privacy@example.com.