Legal · draft

Cookie policy

Last updated: 19 September 2026

Draft notice. We are still reviewing this notice and the wording may change. It describes how we handle personal data today. If anything here is unclear, email hello@beegrow.ai. Hosting and service-provider details for the platform are confirmed in each customer’s data processing terms.

Short version: this marketing website sets no cookies at all, and there is no consent banner because there is nothing to consent to. The customer platform application sets a small number of strictly necessary cookies so that you can stay logged in.

1. This website

beegrow.ai sets no cookies. It runs no analytics, no advertising pixels, no session recording, no heatmaps and no third-party embeds that could set cookies on our behalf.

Because we set no non-essential cookies, we are not required to ask for consent under the Privacy and Electronic Communications Regulations, and we do not display a consent banner. We consider a banner asking permission for cookies that do not exist to be worse than no banner.

Our servers keep standard access logs for security and diagnostics, described in the privacy notice. These are server-side and do not involve storing anything on your device.

2. The platform application

Signed-in users of the BeeGrow AI platform receive the following strictly necessary cookies. These are exempt from the consent requirement because the service cannot be provided without them.

Cookies set by the platform application
NamePurposeExpires
access_tokenKeeps you signed in between requests15 minutes
refresh_tokenRenews your session without asking you to sign in again7 days
trusted_2faSet only if you choose to trust a device, so two-factor authentication does not challenge you on every sign-in7 days
__Host-csrfProtects against cross-site request forgerySession

The lifetimes above are the defaults; your agreement may set shorter ones. In production all four are set with the Secure and SameSite attributes, and none is used for tracking, profiling or advertising.

The three authentication cookies are also HttpOnly, so page scripts cannot read them. __Host-csrf is deliberately not HttpOnly: it holds a random token that the application's own code must read and echo back in a request header, which is what proves the request came from the application rather than from another site. It carries no personal data and grants no access on its own. Its __Host- prefix means the browser will only accept it over HTTPS, scoped to this exact hostname.

The mobile applications store an authentication token in the operating system's secure storage rather than in a cookie. It is removed when you sign out.

3. Local storage

The platform application also stores data in your browser’s local storage. That includes interface preferences such as chosen columns, colour style and date ranges, the identifier of the organisation and farm you are viewing, your session identifier, and a copy of your user profile so the application can render immediately after a refresh. The profile copy includes your name, work email address and role, so this storage does contain personal data.

It is not sent anywhere except as part of a request you make to the platform. Signing out clears the profile and session entries, and clearing your browser data removes all of them.

4. Managing cookies

You can block or delete cookies through your browser settings. Blocking the strictly necessary cookies above will prevent you from signing in to the platform, since there would be no way to maintain your session.

5. If this changes

If we ever add analytics, we intend to use a cookieless, privacy-preserving tool. If we add anything that sets a non-essential cookie, we will implement a proper consent mechanism with an equally prominent reject option before doing so, and update this page.

6. Contact

Questions about this policy: hello@beegrow.ai.