Cookie & Storage Policy
ĀTMAN operates with zero third-party advertising cookies, zero cross-site behavioral trackers, zero Meta Pixels, and zero programmatic advertising SDKs. The primary client-side storage mechanisms permitted are strictly functional and local to your device.
Storage Architecture Explorer
Select a boundary below to inspect how data is scoped, transmitted, and isolated across your browser and ĀTMAN services.
Server Session Cookie (atman_sid)
First-party HTTP response cookie issued exclusively for administrative authentication.
Set-Cookie: atman_sid=...; HttpOnly; Path=/; SameSite=Strict; Max-Age=86400; Secure
Completely inaccessible to client JavaScript. Neutralizes Cross-Site Scripting (XSS) token exfiltration.
Transmitted strictly to the ĀTMAN server over TLS 1.3 encrypted HTTPS requests. Never attached to cross-site requests.
Valid for up to 24 hours (86,400 seconds) from issuance, or destroyed immediately upon logging out.
Client-Side Interface Storage (localStorage)
Functional user preferences and ephemeral interaction states stored locally on your machine.
theme, atmi_persona, atmi_sound_enabled, atmi_voice_enabled, atman_sandbox_draft, atman_workspace_chat
Sandboxed directly within your browser's origin (withatman.in). Never transmitted in HTTP request headers.
Optional Bring-Your-Own-Key values (custom_deepseek_key, custom_gemini_key) reside solely in localStorage and are proxied via sanitizing headers.
Persists across browser sessions until manually wiped through in-app profile settings or browser cache clearing.
Sovereign Client-Encrypted Vault (IndexedDB)
Local structured database housing your cognitive graph and dialogues, encrypted using the Web Crypto API.
atman_vault_db containing object stores: keys, drafts, dialogues, memories
AES-GCM-256 encryption handled in-browser via Web Crypto. Raw thinking vectors and journals remain unreadable to servers.
Zero automatic background sync to remote cloud storage without explicit cryptographic user authorization.
Retained on-device until you execute the Sovereign Eradication Protocol or clear IndexedDB in DevTools.
External Measurement & Auth (gtag.js / Firebase)
Transparent disclosure of third-party runtime scripts integrated into the production client.
Google Tag Manager / Analytics (Tag ID: G-LCDT9GME8B via gtag.js). Utilized for aggregate traffic and route engagement.
Firebase Auth SDK (on login flows) utilizing temporary browser session storage for passwordless magic links.
Google Analytics may generate _ga and _ga_* cookies to distinguish unique visits across pages.
Zero Meta Pixels, zero TikTok / LinkedIn remarketing tags, and zero programmatic advertising bidding networks.
Transparent Local Diagnostic: You can safely inspect what keys your browser currently holds for withatman.in. This runs purely in your local browser and never exposes token values.
withatman.in
The Client Storage Audit Matrix [LEDGER.01]
Unlike cloud-first architectures that centralize your cognitive life on remote servers, ĀTMAN stores application state and cognitive vectors in your browser's local sandbox. The table below provides an exhaustive audit of every verified storage key used across the application:
| Key Identifier | Mechanism & Origin | Lifespan | Technical Purpose & Stored Payload | Necessity & Impact |
|---|---|---|---|---|
| atman_sid | First-Party (Server) | 24 Hours (Session) | Cryptographically signed administrative session identifier for authenticated API and sanctuary routes. | Strictly Essential (Admin auth fails if blocked) |
| theme | localStorage First-Party (Client) | Persistent | Stores your visual interface mode ("dark" or "light") to prevent flash of unstyled content (FOUC). |
Functional (Defaults to dark mode if removed) |
| atman_sandbox_draft | localStorage First-Party (Client) | Persistent | Caches active sandbox thought drafts locally so work is not lost during unintended page refreshes. | Functional (Drafts won't persist across reload) |
| atman_workspace_chat | localStorage First-Party (Client) | Persistent | Local session dialogue cache enabling workspace continuity without polling centralized databases. | Functional (Chat resets upon browser close) |
| atman_cognitive_profile | localStorage First-Party (Client) | Persistent | Client-side cognitive graph containing your derived thinking patterns, salient moments, and topic vectors. | Cognitive State (Profile re-synthesizes if wiped) |
| atman_salient_moments | localStorage First-Party (Client) | Persistent | Highlights and cognitive breakthroughs identified by the local Memory Distiller. | Cognitive State (Local memory resets) |
| atman_vault_db | IndexedDB First-Party (Client) | Persistent | Structured, client-side Web Crypto AES-GCM-256 encrypted storage for private cryptographic keys, drafts, and memories. | Sovereign Vault (Falls back to ephemeral RAM) |
| atmi_* (Mascot) | localStorage First-Party (Client) | Persistent / Ephemeral | Settings including atmi_persona, atmi_sound_enabled (528Hz Solfeggio), atmi_voice_enabled, and atmi_cognitive_memory. |
Mascot Experience (Resets to default Ākṛiti) |
| atman_telemetry_vitals | localStorage First-Party (Client) | Ephemeral | Client-side OpenTelemetry performance metrics and animation framerate vitals. | Performance Optimization (Non-essential) |
| atman_biomarker_labs | localStorage First-Party (Client) | Persistent | Local cache of biometric experiments and cognitive focus sessions conducted in lab environments. | Research Module (Laboratory data resets) |
| atman_email_for_signin | localStorage First-Party (Client) | Temporary | Caches recipient email address during passwordless magic-link sign-in handshake. Purged on completion. | Authentication Handshake (Temporary) |
| custom_*_key (BYOK) | localStorage First-Party (Client) | Persistent | Optional user Bring-Your-Own-Key values (custom_deepseek_key, custom_gemini_key) stored strictly in client memory. |
Optional BYOK (Platform falls back to default model) |
| _ga, _ga_* | Third-Party (Google) | Up to 2 Years | Set by Google Tag Manager (G-LCDT9GME8B) to calculate visitor session counts and aggregate usage statistics. |
Analytics (Can be safely blocked with 0 impact) |
Essential Session Cookies & HTTP Transport Security [LEDGER.02]
Cookies are utilized strictly where required for protocol security in administrative or sanctuary portals:
- HttpOnly Flag Enforced: Authentication cookies cannot be read or exfiltrated by client-side JavaScript, effectively neutralizing Cross-Site Scripting (XSS) attacks.
- SameSite=Strict: Enforces that cookies are never transmitted on cross-site requests, mitigating Cross-Site Request Forgery (CSRF).
- Secure Attribute: Transmission occurs strictly over TLS 1.3 encrypted HTTPS tunnels.
- Zero Advertising Trackers: ĀTMAN sets zero tracking cookies for behavioural profiling or cross-site commercial re-identification.
Third-Party Scripts & Measurement Disclosures [LEDGER.03]
ĀTMAN believes in radical disclosure. While our core cognitive intelligence engine operates client-first, our public web presence incorporates standard production infrastructure:
-
Google Tag Manager / Analytics: The script tag
https://www.googletagmanager.com/gtag/js?id=G-LCDT9GME8Bis loaded asynchronously on public landing pages. It allows our engineering team to assess overall aggregate site stability and page performance. It does not receive your private thinking vectors or local vault contents. - Firebase Authentication SDK: Used on specific authentication routes to support passwordless magic links and OAuth workflows. Firebase may utilize browser session storage to preserve token handshakes.
- Zero Programmatic Ad Networks: ĀTMAN contains no integration with advertising platforms, data brokers, or programmatic bidding networks.
The Sovereign Eradication Protocol [LEDGER.04]
Because your data resides on your machine, you have complete authority to inspect or permanently wipe it at any moment:
-
01In-App One-Click Eradication: Navigate to your profile modal in the bottom navigation bar and select
"DELETE". This instantly purges all local storage keys, memories, encrypted vault databases, and session tokens from your device. -
02Native Browser Developer Tools: Press
F12or right-click >Inspect, open theApplication(orStorage) tab, selectLocal StorageorIndexedDB, and inspect or clear every key stored underwithatman.in. -
03Browser Data Clear: Access your browser's settings menu (
Privacy and Security > Clear Browsing Data) to flush cookies and site data across all domains.
Browser-Specific Management Guides [LEDGER.05]
You do not need specialized software or consent toggles to control client storage. Every modern web browser provides granular native controls:
Google Chrome & Chromium
You can block all third-party cookies or add [*.]withatman.in to custom allowed or blocked storage behaviors.
Apple Safari
Enable "Block All Cookies" or utilize Safari's built-in Intelligent Tracking Prevention (ITP) to partition local storage.
Mozilla Firefox
Set protection to "Strict" to automatically sandbox cross-site cookies and purge tracking storage.
Microsoft Edge
Choose "Block third-party cookies" or review exact storage allocations by site under "See all cookies and site data".
If you have questions regarding our technical storage architecture, cryptographic vault isolation, or would like to report an unlisted key discovered in your environment, our engineering team is directly reachable: