Last updated: October 10, 2026. This English text is a courtesy translation of the Italian original, which prevails in case of discrepancy.
Data controller
K2A S.R.L.S. — Via Alessandro Manzoni 84, Perugia (Italy) · VAT/Tax ID 03655880548 · email: info@k2-ai.it.
1. What cookies are
Cookies and similar technologies (browser storage, caches) are small files or pieces of data saved on your device to make the service work and to remember your session and choices.
2. In short
We use only technical cookies and similar technologies: needed to sign you in, to keep the service secure and to remember your language. We use no analytics, advertising or profiling cookies, so we do not show a cookie consent banner: technical cookies do not require consent. If we ever introduce tools that do, we will ask you first and you will be able to change your choice at any time.
3. What we use
Set by us
- locale — remembers your language (English or Italian). Kept for 12 months. Preference, functional.
- onboarding-flow — remembers that you are going through the first-run steps (preferences, photos, styles), so each screen can show «Step 2 of 4» and take you to the next one. Kept for 3 hours, removed when you finish or skip. Functional, strictly necessary for that path.
- chunk-reloaded (session storage) — a flag that prevents a page from reloading in a loop after an update; removed within seconds and when the tab closes. Strictly necessary.
- stylishai-static-… (cache storage of the offline service) — copies of the application's static files and of the “You're offline” page, so the app opens quickly and works as an installed app. It contains no personal data. Strictly necessary for the installed-app feature.
Set by Clerk, our sign-in provider
- __client_uat and __client_uat_… — a timestamp that tells the page whether you are signed in. Kept for 12 months. Strictly necessary.
- __session — the signed token that proves you are signed in (after you sign in). Short-lived and renewed while you use the app. Strictly necessary.
- __clerk_environment (local storage) — a cached copy of the sign-in configuration. Strictly necessary.
Security (bot protection)
- __cf_bm, _cfuvid — set by Cloudflare through Clerk's sign-in service, to tell people from automated traffic. A session or about 30 minutes. Strictly necessary for security. When you sign up, Cloudflare Turnstile may set similar security cookies.
Payments
- If you buy, the payment page is hosted by Stripe, which sets its own technical cookies there under its own policy.
Things that are not cookies: if the app asks you to rate it, we remember your answer in your account (so we do not keep asking), not in your browser.
4. Legal basis
Technical and security cookies are used on the basis of Art. 6(1)(b) and (f) GDPR, because they are needed to deliver the service and to keep the platform secure, and they do not require consent (Art. 122 of the Italian Privacy Code and the Italian data protection authority's guidelines on cookies).
5. What we do NOT use
No profiling, marketing or third-party analytics cookies. Fonts are hosted on our own systems (self-hosted) and do not trigger requests or cookies to third parties.
6. Managing cookies
You can set your browser to block or delete cookies. Blocking technical cookies may stop you from signing in or make the service work incorrectly. You can change your language at any time with the language switcher.
7. Third parties
Cookies set by third parties are governed by their own policies:
- Clerk — clerk.com/legal/privacy
- Stripe — stripe.com/privacy
- Cloudflare — cloudflare.com/privacypolicy
See also the list of sub-processors in our Privacy policy.