Cookie Policy
Cookies, browser storage, Google Fonts requests and your browser controls on the Avalon Cloud website operated by Avalon Labs LLC.
Effective October 22, 2026. This policy covers getavalon.app, operated by Avalon Labs LLC. The homepage and policy pages use no first-party cookies or advertising or analytics scripts; optional browser sign-in uses a temporary security cookie.
1. Cookies and similar technologies
Cookies are small records a website can ask your browser to store and send with later requests. Browser local storage, session storage and cached resources are different technologies that can also keep information on a device. This policy describes the technologies currently used by the Cloud website; the Privacy Policy covers account and server-side information.
2. What the public website stores
The public homepage and legal pages do not set first-party cookies, store a persistent visitor identifier, or use localStorage or sessionStorage to track visitors. The language is determined by the page URL. No advertising, behavioral profiling or audience-measurement scripts are enabled. Your browser can cache ordinary page resources such as styles, scripts and fonts according to its settings and response headers; this is not a Cloud sign-in record.
3. The account deletion page
The account deletion page uses a verification code and bearer credentials sent only to the same service. The page does not use a login cookie and keeps its email, verification and sign-in state in page memory, without persisting tokens in localStorage or sessionStorage. Refreshing or closing it clears that in-page state. The page requests that browsers avoid caching it. A best-effort sign-out request on leaving the page is not a guarantee that every server session has already ended; expiry, explicit sign-out and account deletion enforce server-side validity. Separately, optional Apple or Google browser sign-in sets __Host-avalon-auth-{sessionId} solely to bind the authorization callback to the browser that started it and prevent sign-in substitution. It contains a random secret, has a maximum ten-minute lifetime, is Secure and HttpOnly with SameSite=None for the Apple form-post callback, and is cleared on completion or expiry. It contains no Avalon access or refresh token and is not used for tracking. Blocking it prevents this browser authorization flow, while public pages and the email deletion flow remain available. Stripe and provider-hosted pages apply their own cookie policies.
4. Google Fonts and external services
The public website requests fonts from fonts.googleapis.com and fonts.gstatic.com. These requests let Google receive connection and request information, including your IP address and browser information, even though we do not add a tracking cookie. Google's own privacy information explains its font service. Verification email delivery through Resend is a server-side account function, not a cookie placed in your browser. Following an external link opens a separate service governed by its own policies.
5. Your browser choices
You can block cookies, clear website data and control cached resources in your browser settings. The current public Cloud pages and email-verified account deletion flow remain available when cookies are blocked. Blocking Google Fonts may cause fallback fonts to be shown. Browser settings affect that browser and do not delete your Cloud account, cancel a subscription or remove server-side records; use the account deletion page or contact us for those requests.
6. Future changes and contact
If we introduce nonessential cookies or similar storage, we will update this policy and provide any choice or prior consent required by applicable law before enabling them. We do not treat your continued visit as consent to future tracking. Questions about cookies or browser storage can be sent to Avalon Labs LLC at [email protected]. The service is offered outside mainland China.