Cookie Policy
Cookie Policy updated on 14 October, 2026
This page lists every cookie and browser storage key that PatentAssist.ai sets, what it is for, and how long it lasts. It covers patentassist.ai, search.patentassist.ai and app.patentassist.ai.
Your choices
We set strictly necessary cookies without asking, because the site cannot work without them. They store no analytics.
What happens with analytics depends on where you are:
- In the European Economic Area, the United Kingdom and Switzerland, no analytics cookies load until you press “Accept analytics” on the banner.
- Everywhere else, Google Analytics runs from your first page view and the banner offers “Opt out”. PostHog still only loads if you press “OK” on the banner.
We work out the region from your IP address, using Cloudflare’s location lookup; if it cannot be determined we treat you as being in the first group.
You can change your mind at any time with the Cookie settings link in the footer. Rejecting or opting out stops PostHog and Google Analytics from loading at all; it does not merely opt you out afterwards. You can also clear cookies and site data in your browser at any time.
Strictly necessary
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
better-auth.session_token |
Cookie | app.patentassist.ai | Keeps you logged in to the drafting app | 30 days, or until you log out |
pa_consent |
Cookie + localStorage | patentassist.ai | Records your cookie choice so we stop asking. Shared with search.patentassist.ai | 6 months |
cf_clearance |
Cookie | Cloudflare | Records that you passed a bot check, so you are not challenged repeatedly | 30 minutes to 1 year, set by Cloudflare |
__cf_bm |
Cookie | Cloudflare | Bot management: distinguishes humans from automated traffic | 30 minutes |
| Turnstile challenge cookies | Cookie | Cloudflare Turnstile | Runs the “are you human” check on the contact and demo forms and on the search app | Session |
pa.turnstile.verified |
localStorage | search.patentassist.ai | Remembers that this browser already passed the Turnstile check, so you are not re-challenged on every page | 30 minutes |
user_token |
localStorage | search.patentassist.ai | A random identifier used to enforce the weekly free-search allowance, show an upgrade or purchase prompt once the allowance is reached, and detect abuse. Not linked to an account and not used for advertising | Until you clear site data; the matching server-side event records are deleted after 180 days |
Preferences
These are set by the site, stored only in your browser, and never sent to us.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
theme |
localStorage | Remembers whether you chose light or dark mode | Until you clear site data |
pa.search-mode |
localStorage | Remembers your last search mode on the search app | Until you clear site data |
pa_search_history |
localStorage | Your recent searches, shown as suggestions in the search box | Until you clear it or clear site data |
pa_saved_searches |
localStorage | Searches you explicitly saved | Until you delete them or clear site data |
Analytics
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
ph_* (e.g. ph_phc_..._posthog) |
Cookie + localStorage | PostHog (EU region) | Product analytics: which pages are visited and which features are used, so we can improve the product | 12 months |
cfz_google-analytics_v4 |
Cookie | Cloudflare Zaraz for Google Analytics 4 | Website analytics: an anonymous visitor ID, so we can count visits, traffic sources and sign-ups | 1 year |
cfzs_google-analytics_v4 |
Cookie | Cloudflare Zaraz for Google Analytics 4 | Website analytics: counters for the current visit | Session |
Google Analytics 4 runs through Cloudflare Zaraz: the measurement requests are sent from Cloudflare’s servers rather than by a Google script in your browser, Google advertising features (Audiences) are switched off, and nothing is sent once you reject or opt out. Google Analytics tells us which search engines and pages bring visitors to the site and how many of them sign up or subscribe.
We configure PostHog to create a person profile only for identified users, and we strip the q search parameter out of every URL it records, so search query text never reaches our analytics.
Cookies we do not set
We do not use advertising, retargeting or cross-site tracking cookies, and we do not run Google Tag Manager or social media pixels. Google Analytics is the only Google service that receives data about your visit, under the rules in Your choices. The blog no longer loads fonts from Google.
More information
Who receives data from these tools, and where they run, is listed on our sub-processors page. How we handle personal data generally is set out in our Privacy Policy. Questions: privacy@patentassist.ai.