Cookies

Effective date: 9 November 2026. Last updated: 9 November 2026.

1. About this Policy

This Cookie Policy explains how SwiftSafe ("SwiftSafe", "we", "us") uses cookies and similar technologies on prava.dev and in the Platform. "SwiftSafe" means the SwiftSafe company responsible for your data, as described in section 1 of the Privacy Policy: SwiftSafe LLC, our United States office, for people and organisations in the Americas, and SwiftSafe Cybersecurity Technologies India Pvt Ltd, our headquarters in India, for everyone else. It forms part of our Privacy Policy. Capitalised terms have the meaning given in the Terms of Service.

2. Cookies and similar technologies

2.1 Cookies

Cookies are small text files that a website asks your browser to store and send back with later requests. First-party cookies are set by the site you are visiting; third-party cookies are set by another domain.

2.2 Local storage and session storage

Browsers also let a website keep small amounts of data on your device in "local storage", which stays until it is deleted, and "session storage", which is cleared when you close the tab. Unlike cookies, it is not sent with every request. We treat these technologies in the same way as cookies for the purposes of this Policy.

2.3 SDKs and third-party resources

A software development kit (SDK) or embedded script from a third party can collect information about how you use a service. Loading a resource such as a font or code library from another provider's network also means your browser sends that provider your IP address and browser details.

2.4 Agent telemetry is different

Agents installed on a Customer's devices, servers and workloads send Telemetry and health signals ("beacons") directly to the Platform over an authenticated, encrypted connection. They do not use browser cookies and are not controlled through browser settings. Telemetry is collected because the Customer has deployed the Agent, and is covered by the Customer's agreement with us and by our Privacy Policy and Data Processing Addendum, not by this Cookie Policy.

3. Categories we use

• Strictly necessary: needed for the website or Platform to work, for example to keep you signed in or to route requests to our API. These cannot be switched off in our Services. EU and UK ePrivacy rules do not require consent for them, because they are essential to the service you asked for.
• Preferences: remember choices you make, such as theme, language and layout.
• Analytics: help us understand how the Platform is used so we can improve it. The public website does not currently use any.
• Security: protect your account and our Services, for example by holding session tokens securely and detecting suspicious sign-ins.

We do not use advertising or cross-site tracking cookies.

4. What the website and Platform store

This list reflects a review of the website and Platform code on 9 November 2026. None of the items below is a cookie; all are browser storage set by us (first party) unless stated otherwise.

4.1 prava-theme

Where: website and Platform. Purpose: remembers whether you chose the light or dark colour theme. Duration: until you clear it or change the setting. Type: local storage, preferences.

4.2 prava-access and prava-refresh

Where: Platform. Purpose: hold the access and refresh tokens that keep you signed in and authenticate your requests to our API. Duration: by default, until you close the tab; if you tick "Remember me", until you sign out or the token expires. Type: session storage (local storage with "Remember me"), strictly necessary and security.

4.3 prava-auth, prava-remember and prava-workspace

Where: Platform. Purpose: record that you are signed in, whether you chose "Remember me", and which workspace is active. Duration: until you sign out or close the tab, as applicable. Type: local and session storage, strictly necessary.

4.4 prava-api and prava-classic-url

Where: Platform. Purpose: store the address of the API and of the classic dashboard view so the Platform connects to the right service. Duration: until cleared. Type: local storage, strictly necessary.

4.5 prava-continue

Where: Platform. Purpose: briefly carries text from one assistant view to another when you choose to continue a conversation. Duration: deleted as soon as it is read, or when you close the tab. Type: session storage, strictly necessary.

4.6 prava-lang and prava-lang-synced

Where: Platform. Purpose: remember your language and avoid re-syncing it with your account during a session. Duration: until cleared, and until the tab closes, respectively. Type: local and session storage, preferences.

4.7 Layout and assistant preferences

Names: prava-collapsed, prava-sidebar-w, prava-oppanel-w, prava-model, prava-preview and prava-pref-* (for example notification and sign-in settings). Purpose: remember sidebar and panel sizes, your chosen assistant model, whether preview features are on, and your notification and similar settings on this device. Duration: until cleared. Type: local storage, preferences.

4.8 prava-team

Where: Platform. Purpose: keeps team set-up details, such as the team name, on this device while you configure your workspace. Duration: until you sign out, delete the team or clear storage. Type: local storage, strictly necessary.

4.9 prava-chats and prava-chats-removed

Where: Platform. Purpose: keep a list of scans you ran while signed out, and the ones you removed, so they appear in your history on this device. This may include the targets and results of those scans. Duration: until you remove them or clear storage. Type: local storage, strictly necessary.

4.10 prava-billinfo and prava-plan-cancelled

Where: Platform. Purpose: keep the billing contact name, email and address you enter, and whether you have cancelled your plan, until our payment system takes over these records. Duration: until cleared. Type: local storage, strictly necessary.

4.11 Google Fonts (third party)

Where: Platform. Purpose: loads the IBM Plex typefaces from fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address and browser details when the fonts load. Duration: not applicable; we are not aware of cookies being set by this service. Type: third-party resource, strictly necessary for display.

4.12 cdnjs (third party)

Where: Platform. Purpose: loads the open-source socket.io library (for live updates) and a QR-code library (when you set up features that show a QR code) from cdnjs.cloudflare.com. The provider receives your IP address and browser details. Duration: not applicable. Type: third-party resource, strictly necessary.

4.13 Server and security logs

Where: website and Platform. Purpose: our servers, hosted in data centres in your own region, record IP address, browser type and requested pages to run and protect the Services and, where they apply, to meet CERT-In log requirements. Duration: see the retention section of the Privacy Policy. Type: server-side, security. This involves no storage on your device.

4.14 Other items

Names: [Any further cookies or SDKs added before launch]. Purpose, duration and type: to be confirmed. We will update this list before introducing any new cookie or similar technology.

5. Platform analytics

As explained in our Privacy Policy and Terms of Service, we collect usage analytics in the Platform, such as features used, pages viewed, errors and performance, to operate and improve Prava AI. Analytics are collected using [Product analytics provider], which may set [cookie or storage names, purpose and duration]. Where Applicable Law requires consent for analytics cookies or similar technologies, for example for users in the EU or UK, we will ask before setting them and you can change your choice at any time. We do not use analytics for advertising. How analytics feed into model improvement is described in our AI and Data Use Policy.

6. How to control them

• Browser settings: you can block or delete cookies and site data, including local and session storage, in your browser's privacy settings. Clearing site data for prava.dev will sign you out of the Platform and reset your preferences.
• Remember me: leave "Remember me" unticked when signing in to keep your session tokens in session storage only, so they are removed when you close the tab.
• Platform settings: you can change preferences such as theme, language and notifications in your account settings, and, once available, your analytics choices.
• Blocking third-party resources: if you block Google Fonts or cdnjs, the Platform will still work but may look different or lose live updates.

Strictly necessary storage cannot be disabled while you use the Platform, because the Platform cannot keep you signed in or secure without it.

7. Do Not Track and Global Privacy Control

There is no agreed standard for how websites should respond to Do Not Track (DNT) signals, so we do not change our behaviour in response to them.

We honour the Global Privacy Control (GPC) signal. If your browser sends GPC, we treat it as a request to opt out of the sale or sharing of personal information under the CCPA/CPRA and similar US state laws, and, where we use analytics that need consent, as a refusal of that consent for that browser. We do not sell or share personal information for cross-context behavioural advertising.

8. Changes and contact

We will update this Policy when we add, remove or change cookies or similar technologies, and change the "Last updated" date. If a change requires your consent, we will ask for it before the change takes effect. Questions can be sent to privacy@prava.dev. For our other legal documents, see the Legal centre.