Cookie policy
Last updated: 19 September 2026
Draft notice. We are still reviewing this notice and the wording may change. It describes how we handle personal data today. If anything here is unclear, email hello@beegrow.ai. Hosting and service-provider details for the platform are confirmed in each customer’s data processing terms.
Short version: this marketing website sets no cookies at all, and there is no consent banner because there is nothing to consent to. The customer platform application sets a small number of strictly necessary cookies so that you can stay logged in.
1. This website
beegrow.ai sets no cookies. It runs no analytics, no advertising pixels, no session recording, no heatmaps and no third-party embeds that could set cookies on our behalf.
Because we set no non-essential cookies, we are not required to ask for consent under the Privacy and Electronic Communications Regulations, and we do not display a consent banner. We consider a banner asking permission for cookies that do not exist to be worse than no banner.
Our servers keep standard access logs for security and diagnostics, described in the privacy notice. These are server-side and do not involve storing anything on your device.
2. The platform application
Signed-in users of the BeeGrow AI platform receive the following strictly necessary cookies. These are exempt from the consent requirement because the service cannot be provided without them.
| Name | Purpose | Expires |
|---|---|---|
access_token | Keeps you signed in between requests | 15 minutes |
refresh_token | Renews your session without asking you to sign in again | 7 days |
trusted_2fa | Set only if you choose to trust a device, so two-factor authentication does not challenge you on every sign-in | 7 days |
__Host-csrf | Protects against cross-site request forgery | Session |
The lifetimes above are the defaults; your agreement may set shorter ones. In production all four are set with the
Secure and SameSite attributes, and none is used for tracking, profiling or advertising.
The three authentication cookies are also HttpOnly, so page scripts cannot read them.
__Host-csrf is deliberately not HttpOnly: it holds a random token that the application's own
code must read and echo back in a request header, which is what proves the request came from the application rather
than from another site. It carries no personal data and grants no access on its own. Its __Host- prefix
means the browser will only accept it over HTTPS, scoped to this exact hostname.
The mobile applications store an authentication token in the operating system's secure storage rather than in a cookie. It is removed when you sign out.
3. Local storage
The platform application also stores data in your browser’s local storage. That includes interface preferences such as chosen columns, colour style and date ranges, the identifier of the organisation and farm you are viewing, your session identifier, and a copy of your user profile so the application can render immediately after a refresh. The profile copy includes your name, work email address and role, so this storage does contain personal data.
It is not sent anywhere except as part of a request you make to the platform. Signing out clears the profile and session entries, and clearing your browser data removes all of them.
4. Managing cookies
You can block or delete cookies through your browser settings. Blocking the strictly necessary cookies above will prevent you from signing in to the platform, since there would be no way to maintain your session.
5. If this changes
If we ever add analytics, we intend to use a cookieless, privacy-preserving tool. If we add anything that sets a non-essential cookie, we will implement a proper consent mechanism with an equally prominent reject option before doing so, and update this page.
6. Contact
Questions about this policy: hello@beegrow.ai.