Cookie Policy

ahhh.ai uses browser cookies and local storage to deliver our video creation service, remember your preferences, and keep your session secure.

Checkout is handled by Waffo. Cookies set on Waffo's site are not set by ahhh.ai and are not listed here.

Set by ahhh.ai in the browser, or by Better Auth on sign-in.

locale. On account pages and API paths, ahhh.ai stores the value en for 1 year (Path=/, SameSite=Lax). A non-English choice is not stored. Public pages do not set this cookie.

es_device. A random device id. The same value is copied to localStorage under es_device. The cookie lasts 1 year and stays on this site's own domain. The site sends the same id to the API and to sign-in in the x-device-id header, so the cookie itself is not sent to the API.

ui-theme. An inline script on each page sets this cookie to light for 1 year (Path=/, SameSite=Lax). The same script removes the localStorage item ui-theme. The site stays in light mode.

sidebar_state. On a signed-in page, opening or closing the sidebar writes this cookie for 7 days (Path=/). The signed-in layout reads it and starts with the sidebar open unless the value is the string false.

better-auth-v2.session_token. Better Auth sets this cookie when you sign in. It lasts 7 days. When the site is ahhh.ai and the API is api.ahhh.ai, the cookie domain is ahhh.ai. Test environments use a separate host, so their cookies are never sent to ahhh.ai. On https the name is __Secure-better-auth-v2.session_token. Outside localhost the cookie is HttpOnly. When the site and the API share a parent domain, SameSite is Lax.

better-auth-v2.session_data. Better Auth stores a short-lived copy of the session in this cookie because the session cookie cache is on. It lasts 1 hour. On https the name is prefixed with __Secure-. A long value can be split into numbered cookies such as better-auth-v2.session_data.0.

ahhh_consent. The analytics choice for this browser: granted or denied. It lasts 396 days (Path=/, SameSite=Lax) and is the copy the server reads, so a refusal keeps the analytics script out of the page source on later visits. Accepting or withdrawing consent overwrites it.

_pv_id. The analytics visitor id, a random value. It is written only after analytics consent, or straight away for visitors outside the EEA, the UK and Switzerland. The cookie lasts up to 396 days.

_pv_sid. The analytics session id. It lasts 1 day and is renewed while the tab is in use.

_pv_ft. First-touch campaign data: utm_source, utm_medium, utm_campaign and the referrer. It lasts up to 396 days.

_pv_v. The bot-check verdict for this browser. It lasts 7 days.

These values stay in localStorage until site data is cleared, except where a time limit is written below.

es_device. The same random device id as the es_device cookie. It stays until site data is cleared.

pwa-install-prompt-dismissed. The time the install prompt was dismissed. The prompt stays hidden for 7 days after that time.

analytics.firstTouch. Referrer host, utm_source, utm_medium, utm_campaign, landing path, and the time of the first visit in this browser. Written once.

analytics.acquisitionReported:. Prefix plus the user id. Marks that this browser already sent that first-touch record.

analytics.lastTemplate. The template id last opened in the studio, so a later credit purchase can be tied to it.

analytics.once:. Prefix plus an event key. Marks a one-time analytics event, including sign-up, a finished or failed video, and a purchase.

credits.unfinishedShown:. Prefix plus the order id. Marks that this browser already offered that unfinished credit order.

_pv_id. The same analytics visitor id as the _pv_id cookie. It stays until analytics consent is withdrawn or site data is cleared.

pvuv.consent. The analytics choice for this browser: granted or denied. It stays until consent is withdrawn or site data is cleared.

These values stay in sessionStorage until the tab closes.

ahhh.pricingCheckout. The credit pack to resume after sign-in.

ahhh.pricingCheckoutReturn. The page to return to after that checkout.

ahhh.pricingCheckoutOwner. Whether the pricing page or the buy-credits dialog owns the resume.

ahhh.pricingCheckoutSignIn. Set to 1 when sign-in starts from the pricing page, so a reload can resume that attempt.

ahhh.pricingCheckoutDialogSignIn. Set to 1 when sign-in starts from the buy-credits dialog.

credits.pendingOrderId. The order id to match when the buyer comes back from checkout.

analytics.auth:. Prefix plus the user id. Keeps sign-in or sign-up from being sent twice in the same tab.

render-alert:. Prefix plus the video job id. Set when you ask for a browser notification for that render.

video-studio. IndexedDB database video-studio, object store handoff, key pending. Holds the photo files picked before sign-in and before the credit purchase dialog opens. The record is deleted when the video job is created.

app-static-. Cache Storage name prefix. The service worker appends the build id. The cache holds the offline page, the web app manifest, the PWA icons, and same-origin files under /assets/ and /pwa/. A newer build deletes older caches with this prefix. Navigations are fetched from the network.

When a build enables Google Analytics, each page loads https://www.googletagmanager.com/gtag/js and calls gtag with config for that measurement id. That config does not send the automatic page view. The page-view tracker sends page views after that. The same gtag call sends sign-up, login, video, checkout, and purchase events.

Google's script may store its own cookies. This site's code does not name those cookies, so their names are not listed above.

ahhh.ai also runs its own statistics server at https://stats.kandiideas.com. The script is loaded from that host, sends page views and interaction events back to it, and nothing goes to pvuv.ai or to another analytics provider. The server runs on Cloudflare in our own account.

The script writes the _pv_ cookies and the _pv_id localStorage value listed above. It reads canvas output and, on Android, device motion signals to tell bots from people. The IP address is kept only as a one-way hash.

In the EEA, the UK and Switzerland the tag is not in the page until you choose Accept in the consent banner. Outside that area it loads with the page unless you have refused. Refusing, or withdrawing later, is recorded in the first-party ahhh_consent cookie, and the server leaves the tag out of the page it sends while that cookie says denied. Signed-in and admin pages do not load the script at all. The footer item Cookie settings reopens the banner and withdraws consent. A short-lived _pv_t cookie is used while the script looks for the widest cookie domain, and _pv_uid is written only if a page calls its identify method, which this site does not.

Email sign-in loads https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit. The token is sent in the x-captcha-response header. This site's code does not set a named Turnstile cookie.

We provide a live support and feedback chat widget powered by Tawk.to. The widget loads from https://embed.tawk.to/{property}/{widget}, opens in the bottom-right corner of your screen, and is hidden on sign-in pages. Tawk.to sets its own cookies and browser storage so the conversation survives a page change; this site's code does not name those items, so they are not listed above. Read the Tawk.to Privacy Policy at https://www.tawk.to/privacy-policy/.

You can block or delete cookies through your browser settings at any time. Please note that disabling essential storage may prevent you from signing in or generating videos.

The footer item Cookie settings withdraws analytics consent. Withdrawing deletes the _pv_ cookies and the _pv_id localStorage value, removes the script tag, records the refusal in localStorage and in the ahhh_consent cookie, and reloads the page so a script that already ran stops. The cookie is part of the next request, so later page loads arrive without the tag.

Removing the sign-in cookies signs you out. Removing locale, es_device, ui-theme, or sidebar_state drops those saved values. Removing site data drops the photo handoff, the checkout resume, the analytics markers stored in this browser, and the Tawk.to chat state.

If you have any questions about our cookie and storage practices, please contact us at support@ahhh.ai.