Company pages
Cookies & Analytics
Every cookie talonlabs.dev sets, everything it stores in your browser, and exactly what our analytics collect. Meant to be complete rather than reassuring — if something is missing here, that is a bug.
The short version
This page covers this website. Self-hosted Talon Studio runs on your own server and is covered by its own documentation; what it does with your organisation's data is on Data handling.
Sign-in cookies
These are set when you sign in, or start to: pressing Sign in or Create account asks the authentication library for an anti-forgery token, which sets the two authjs cookies, and a successful sign-in sets the session and its hint. They carry no consent choice because there is no meaningful choice to offer: refusing them means refusing to sign in. All are first-party and Secure in production, and all but one are HttpOnly — unreadable by JavaScript, including ours.
| Cookie | Purpose | Expires | SameSite |
|---|---|---|---|
talon_labs_session | Your signed-in session — a signed token identifying your account to the server on each request. | 30 days | Lax |
talon_labs_auth | One readable bit, “somebody is signed in here”, so a page can draw the right navigation before it has loaded. It holds no identity and authorises nothing. The one cookie that is not HttpOnly, because being readable is its purpose. | With the session | Lax |
__Host-authjs.csrf-token | Anti-forgery token. Stops another website submitting forms to us as you. | Session | Lax |
__Secure-authjs.callback-url | Remembers which page to return you to after sign-in. | Session | Lax |
talon_labs_webauthn_auth | One-time challenge for signing in with a passkey. | 2 minutes | Strict |
talon_labs_webauthn_reg | One-time challenge for registering a new passkey. | 2 minutes | Strict |
The two authjs cookies come from Auth.js, the authentication library we use, and are listed under the names the browser shows in production. On a local development server the __Host- and __Secure- prefixes are absent, because those prefixes require HTTPS.
Other browser storage
Not cookies — these live in your browser's local storage, are never sent to our servers, and exist only so the site behaves the way you left it. Clearing this site's data removes them.
| Key | Purpose | Kept until |
|---|---|---|
talon-theme | Whether you chose the light or dark theme. | You clear it |
talon-consent | Your answer to the consent banner, so we stop asking. Storing this is what makes a refusal stick. | You clear it, or the policy changes |
talon-banner:* | Which announcement banners you have dismissed. | You clear it |
talon_ignore | A manual analytics opt-out for our own staff. Never set automatically. | You clear it |
docs scroll position | Keeps your place in the documentation sidebar. Session storage — gone when you close the tab. | You close the tab |
Analytics
Nothing in this section runs until you accept it. If you decline, or have not answered yet, none of these scripts load and no request is made to any of them. We use three, and none sets a cookie or can recognise you on another website:
| Service | Run by | What it collects |
|---|---|---|
| Talon traffic collector | Us, on our own server | Page path, referrer, UTM campaign tags, scroll depth, time with the tab actually in front of you, browser, operating system, device type, and a two-letter country code. |
| Vercel Web Analytics | Vercel Inc. (United States) | Page views and visit counts, page path, referrer, campaign tags, country, device and browser type; and a few named steps — a call to action pressed, the sign-up screen shown, an account created, a Google or GitHub button pressed, a key revealed or copied on the account page, a command copied from the docs, each with the product and the page path; the home page's recorded introduction played, that introduction reaching Talon Studio, that introduction heard to the end, the home page's agent arrows pressed — never an address, name or key. |
| Vercel Speed Insights | Vercel Inc. (United States) | Page loading performance measurements (Core Web Vitals) for the pages you visit. |
Only the page, never the rest of the address. Before any of the three reports a page, everything after the path is removed except campaign tags (utm_source and the like), and our own collector does the same to the address you came from — so the one-time token and address in a verification or password-reset link never reach an analytics store.
How they count visitors without cookies. Instead of tagging your browser, both our collector and Vercel's derive a one-way hash from your IP address, your browser's user-agent string and a secret that changes every day. The hash is what gets stored; your IP address is not. Within one day the hash links one browser's page views together, which is how a visit is counted as one. Because the secret rotates daily and is then destroyed, the hash cannot be reversed, and the same visitor on two different days produces two unrelated values — so no history of one person builds up across days, and no cookie is needed.
Not joined to anything you tell us. An enquiry you send us, or an address you leave with the assistant, is not matched to your analytics visits.
Retention. Our own collector keeps individual events for 180 days and then rolls them into daily totals containing no per-visitor rows. The daily secret is deleted after 48 hours. Vercel's retention is governed by their privacy notice; they act as our processor under a data processing agreement, and the transfer to the United States relies on the EU and UK Standard Contractual Clauses.
The site assistant
If the chat assistant is available on this deployment, opening it and asking a question sends that question — with the conversation so far and the part of our own documentation it matched — to Anthropic, whose Claude model writes the answer. Anthropic acts as our processor for that call. Nothing is sent until you type something and press send, and the assistant is not gated behind the analytics consent because it is a function you chose to use rather than a measurement of you.
| Recorded | Not recorded |
|---|---|
| Your question exactly as you typed it, the answer given, the page you asked from, which documentation pages were cited, and a conversation id generated by your browser to group one chat together. | No IP address, no user-agent string, no cookie and no link to an account — including if you have one and are signed in. |
Those records are deleted after 90 days. Because a question is kept as typed, anything personal you write into it — an email address included — is kept with it for those 90 days. The conversation id is generated fresh for each chat, is not stored in your browser, and is not a key we can look anything else up by. If you leave an address with the assistant so we can reply, it and your note are stored as an enquiry (kept twelve months) and mailed to our inbox with that conversation, so we can see what you asked; the conversation record itself is not linked to your address.
What we do not do
Changing your mind
Use Cookie preferences in the footer of any page, or clear this site's data in your browser settings, which removes everything in the tables above. Your choice is stored per browser and per device, so declining on your laptop does not carry to your phone. If we ever change what we collect, the banner returns and asks again rather than assuming your previous answer still applies.
Browser-level signals are honoured where we can see them: turning off JavaScript, or blocking our analytics with an extension, produces the same result as declining.
Anything about this page, or a request to see what we hold: the contact form (topic: Privacy or data request).