Cookie Policy

Last Updated: October 27, 2026

This policy describes cookies and similar browser storage used by Lithi sign-in and connection flows, public-site measurement, and the embedded widget. The items present depend on the page and feature you use. A cookie or browser identifier does not give Lithi permission to read a connected account or send a message.

Lithi Technologies LLC ("Lithi," "we," "us") uses cookies and similar technologies on lithi.ai and our embedded widget.

Contents

• Sign-in and account connections
• Privacy choices
• Public-site measurement
• Ask Lithi visitor memory
• Embedded widget storage
• Ask Lithi chat session
• Invitation and enablement links
• Browser controls
• Contact
• Related policies
• Primary action

Sign-in and account connections

Supabase-managed cookies keep an authenticated session. Their lifetime follows the session settings rather than a single period used on every account.

Shopify, QuickBooks, and Gmail connection flows use short-lived OAuth state cookies while the account connection is checked. The current flows set these state cookies for up to ten minutes. They do not store the connected service's password.

Privacy choices

A short cookie notice appears on your first visit with Accept, Reject, and Manage. Manage opens Privacy choices, which you can also open from the footer at any time. The notice stays until you save a choice. In the EU, EEA, United Kingdom, and Switzerland, Ask Lithi uses visit personalization only after you allow it. Elsewhere, it uses permitted visit context by default with notice. Visitor memory also requires that it is enabled for this browser; allowing personalization does not by itself enable memory. Reject, turning off both choices in Privacy choices, or Global Privacy Control turns off site measurement and personalization for this browser. Advertising measurement is a separate choice and stays off everywhere until you enable it. Advertising choices do not enable or disable chat personalization. Lithi's own site measurement can record pages opened, time on page, scroll depth, sections viewed, arrival source, Ask Lithi opens, and Ask Lithi action or link clicks. It stays on by default unless you reject it, save both choices as off, or use Global Privacy Control. This record stays on Lithi's systems and is not shared with an advertising provider. Sign-in, account connection, and the chat session use separate essential storage.

The site stores your choices in the lithi_privacy_v1 cookie for up to 180 days. With no saved choice, advertising measurement stays off; site measurement stays on, and visit personalization follows the region rule above. An expired, invalid, or ambiguous saved choice leaves advertising measurement, site measurement, and personalization off. A saved opt-out is not replaced by an automatic default. Withdrawing personalization stops new memory use, clears the current memory, and expires the visitor identity cookies. It prevents earlier activity from restoring the memory. It does not erase raw analytics, lead, chat, rating, or provider records already created.

Public-site measurement

When permitted, the server-signed visitor and visit cookies associate pages and sections seen during one browser visitor's visits. The site uses the server-signed lithi_visitor_v1 cookie; the localStorage value in _lithi_visitor_id is only a fallback hint. Lithi does not build this activity record from device details, use it as a fingerprint, or use it to read credentials or a connected account.

Site measurement can record the channel and named AI assistant or agent that brought you here, the arrival page and month, pages and sections you viewed, estimated reading opportunity, and Ask Lithi opens, actions, and link clicks. Estimated reading opportunity describes what was available to read; it does not prove that you read or understood it. A source or assistant name is used for measurement and permitted personalization, not shown in Ask Lithi unless you raise it.

For the length of your visit, the site also remembers which page and campaign link brought you here, so a sign-up can record where it came from. This follows the site measurement choice and never includes advertising click IDs. Advertising measurement requires its own saved choice. When advertising measurement is enabled, the website can set _meta_ext_id for up to two years for that advertising activity. Advertising measurement additionally uses Meta Pixel and the Conversions API for permitted visits, interactions, and submitted lead events, with _fbp and _fbc cookies for up to 90 days. Identifier synchronization may also set the HttpOnly _fbp_server and _fbc_server cookies for up to 90 days. Related identifiers can be kept in browser storage. Identifier synchronization uses this browser's cookies; it does not look up another visitor or store an identifier database record.

Meta Pixel loads only when advertising measurement is enabled, Global Privacy Control is absent, and a valid Pixel ID is configured. The corresponding server path can send event and matching information to Meta. See service providers and subprocessors for its purpose and data categories. Browser settings can block or delete browser storage; clearing a cookie does not necessarily remove a separate server-side record.

Ask Lithi visitor memory

Where visitor memory is enabled for this browser and personalization is allowed, Ask Lithi can use it to make a later visit easier. In the EU, EEA, United Kingdom, and Switzerland, memory waits for personalization consent. Elsewhere, enabled memory follows the region's notice-based personalization permission. Allowing personalization does not by itself enable memory. It is never used when Global Privacy Control or a saved opt-out turns personalization off.

The memory can include the source channel, named AI assistant or agent, arrival month, public pages and sections you visited, estimated reading opportunity, product topics, pending conversation threads, language and answer-depth preferences, and lead-submission status as a plain fact. It can also include visitor-stated facts about your Mac model, chip, memory, Mac count, hours per day, use case, team size, country, or language. It does not include contact details, form contents, secrets, or sensitive facts. Current prices and earnings are never reused from memory.

Ask Lithi sends your chat and relevant page context to Anthropic to generate an answer. Visitor memory is separate from that raw chat and from separately retained chat exchanges and ratings. Lithi writes only selected product topics and facts to visitor memory after filtering; the original chat may contain personal information.

Where visitor memory retention is enabled, memory is kept for up to 365 days after the last permitted memory signal. Page observations used for current-visit chat context are kept for 90 days and embedded-widget page-view records for 180 days. Chat exchanges, ratings, leads, and provider records are separate records with separate purposes and retention. When a memory experiment is enabled, a stable ten percent of eligible returning visitors receives no memory personalization for eight weeks so Lithi can measure whether memory helps; chat continues to work for that group. The holdout is a measurement choice, not a different privacy choice.

Ask Lithi can answer “What do you remember about me?” with a plain summary. Choose Forget me in Privacy choices or in chat to erase this browser's visitor memory, record the request without visitor content so earlier activity cannot restore the memory, and expire both visitor identity cookies. Your next visit starts as a new visitor. Turning personalization off also clears current memory and prevents earlier activity from restoring it. These controls do not promise erasure of raw analytics, lead, chat, rating, or provider records.

Embedded widget storage

The embedded widget script keeps a visitor identifier in _lithi_vid for up to one year and uses its own localStorage and sessionStorage keys for visitor, session, and attribution information. The script executes on the page where it is embedded. On a merchant site, its _lithi_vid cookie and storage belong to that site's browser origin. They are separate from Lithi's lithi_visitor_v1 and from unrelated merchant cookies; the script reads its own named identifier.

Ask Lithi chat session

Ask Lithi uses a per-tenant __Host-lithi_chat_v1_<tenant-prefix> cookie on HTTPS. It is HttpOnly, Secure, SameSite=Lax, and scoped to the host root. The cookie has no Max-Age or Expires attribute, so the browser treats it as a session cookie. The signed chat-session authority expires after 30 minutes. That session lifetime controls access to current-session chat context; it does not state how long an exchange, rating, or other server-side record is retained.

Invitation and enablement links

Opening a Lithi invitation or enablement link may set lithi_vid and lithi_rep visitor/representative cookies for up to one year. These are separate from the embedded widget's _lithi_vid cookie. A pending join-state cookie lasts up to ten minutes. Referral and UTM attribution cookies may last up to 30 days. These markers help the related flow continue; they do not approve access to an account or authorize a message.

Browser controls

Use Privacy choices in the footer to change or withdraw advertising measurement and visit-based personalization. Enable Global Privacy Control to disable site measurement and visit personalization for this browser; existing saved personalization opt-outs remain respected. Choose Forget me to erase visitor memory and expire both identity cookies. Your browser settings can also block or clear cookies and other browser storage. Blocking them can interrupt sign-in, account connections, widget recognition, or attribution. Clearing a browser item does not by itself delete a separate server-side record.

Contact

Lithi Technologies LLC, 68 Harrison Avenue, Suite 605, Boston, MA 02111. Email privacy@lithi.ai for a privacy request.

Related Policies

Privacy Policy · Terms of Service · Data Processing Agreement

Primary action

Request a current cookie review