Version: 2026-09-27.
Provider: AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920.
Last updated: 27 September 2026
1. Who operates this site
This cookie policy applies to https://atly.chat (“AtlyChat”, “we”, “us”), operated by AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920.
Contact: admin@atly.chat · +420 736 354 123 (mobile) · +420 233 113 271 (landline).
2. What this policy covers
A cookie is a small text file stored on your device when you use AtlyChat. This page lists the cookies AtlyChat sets on atly.chat (first-party), and briefly notes cookies that third parties may set on their own domains.
AtlyChat does not show a cookie consent banner and does not offer a “Cookie settings” page. The product does not set third-party advertising cookies or a cookie that records cookie consent. You can block or delete cookies in your browser; some features then stop working.
3. Cookies AtlyChat sets (first-party)
Unless noted, these cookies use Path / and SameSite=Lax. Secure (and __Secure- / __Host- name prefixes) apply when the site is served over HTTPS.
3.1 Essential — sign-in and security (Auth.js)
| Cookie name | Purpose | Lifetime |
|---|---|---|
__Secure-authjs.session-token or authjs.session-token | Keeps you signed in (encrypted JWT session). | 30 days |
__Host-authjs.csrf-token or authjs.csrf-token | Protects Auth.js flows against cross-site request forgery. | Browser session |
__Secure-authjs.callback-url or authjs.callback-url | Remembers where to return after sign-in. | Browser session |
__Secure-authjs.pkce.code_verifier or authjs.pkce.code_verifier | OAuth PKCE verifier during Google / Microsoft sign-in. | 15 minutes |
__Secure-authjs.state or authjs.state | OAuth state during Google / Microsoft sign-in. | 15 minutes |
3.2 Essential — product flows
| Cookie name | Purpose | Lifetime |
|---|---|---|
atlychat_subscribe_intent | After you start paid subscribe from pricing, keeps the intent through register / verify / sign-in so Checkout can open. Legacy name atlychat_auth_next may still be cleared. | 30 minutes |
atlychat_guest_<groupId> or __Host-atlychat_guest_<groupId> | Guest access cookie for a specific group invite (name includes the group id). | 30 days |
atlychat_action_oauth_state, atlychat_action_oauth_id | Short-lived state while connecting an assistant Action via OAuth. | 10 minutes |
atlychat_connector_oauth_state, atlychat_connector_oauth_pkce, atlychat_connector_oauth_provider, atlychat_connector_oauth_return, atlychat_connector_oauth_assistant | Short-lived state while connecting mail / calendar / Drive (or similar) connectors via OAuth. | 10 minutes |
atlychat_atly_pkce, atlychat_atly_state | Short-lived PKCE and state while connecting the optional Atly Office integration. | 10 minutes |
3.3 Preferences and first-party attribution
| Cookie name | Purpose | Lifetime |
|---|---|---|
locale | Remembers the UI language you chose (HttpOnly). | 1 year |
theme | Remembers light / dark / system theme preference. | 1 year |
atlychat_acq | Stores UTM / referral attribution (source, medium, campaign) for AtlyChat’s own funnel metrics. Not a third-party ad cookie. | 30 days |
4. Third parties (not set by AtlyChat as named session cookies)
- Stripe Checkout. When you subscribe or top up on Stripe’s hosted Checkout, Stripe may set cookies on Stripe’s domain. AtlyChat does not set
__stripe_mid/__stripe_sidon atly.chat as its own session cookies. - Cloudflare Turnstile. Bot checks on login, register, and password forms run in Cloudflare’s widget. Challenge state lives in Cloudflare’s frame context, not as an AtlyChat-named cookie on atly.chat.
- Google / Microsoft sign-in and connector OAuth. Those providers may set cookies on their own domains under their policies.
AtlyChat does not use third-party advertising cookies on atly.chat.
5. How to control cookies
Use your browser settings to block, delete, or limit cookies. Blocking essential cookies prevents sign-in, guest group access, and OAuth connect flows.
6. Changes and contact
We update this page when the cookies the product sets change. Questions: admin@atly.chat.