1. Scope
This Cookie policy explains how Spek, operated by RELOAD TECHNOLOGIES - FZCO in Dubai, United Arab Emirates, uses cookies and similar browser storage on its websites and applications (the "Service"). It should be read with the Privacy policy.
2. Storage technologies
A cookie is a small value a website asks a browser to store and send with later requests. Local storage is browser storage that remains on a device and is read by client-side code; unlike a cookie, it is not automatically sent with each network request.
Spek uses these technologies to keep users signed in, complete an requested subscription purchase, remember the active workspace, retain a requested theme, and preserve browser-side copies of agent workflow and rule settings.
3. Authentication storage
Authentication cookies maintain sessions, refresh access, and complete supported sign-in callbacks. They commonly use an sb- prefix with an auth-token identifier and may include related verifier or numbered chunk cookies.
Their names and lifetimes vary with the relevant authentication session and sign-in flow. These cookies use Secure and SameSite=Lax attributes.
4. Billing intent cookie
The spek_billing_intent cookie, named __Host-spek_billing_intent in production, temporarily carries an opaque purchase capability between Spek's subscription review and Stripe Checkout. The cookie does not contain a card number, price, workspace name, or Stripe secret. The server revalidates its user, plan, cycle, expiry, and active-workspace relationship before creating Checkout.
This strictly necessary first-party cookie is HttpOnly, uses SameSite=Lax and Path=/, uses Secure in production, and expires after one hour unless it is replaced or cleared earlier.
5. Active workspace cookie
The aso_active_workspace cookie records the workspace selected by an authenticated user so the Service can resolve subsequent requests in the correct authorized workspace. It is an essential or functional first-party cookie, is HttpOnly, and expires after one year unless it is replaced or cleared earlier.
The cookie contains a workspace identifier, not the workspace's store credential. Selecting a workspace is also subject to an authenticated membership check. The cookie uses Secure and SameSite=Lax attributes.
6. Local storage
Spek uses the following local-storage values:
- Theme preference (aso-theme):remembers a user's light or dark theme preference. Choosing the system setting removes the stored preference;
- Agent workflow preferences (aso-agent-flows-v12): preserves a browser-side copy of the authored agent workflow library and its active workflow; and
- Agent rule preferences (aso-agent-rules-v6): preserves a browser-side copy of authored agent rules used by the rule editor.
These settings remain until you clear them or reset the relevant feature. Clearing browser storage removes the browser copy but does not delete your account or server-side data.
7. Duration
A session cookie generally ends with the browser session, while a persistent cookie or local-storage value remains until its configured expiry or until it is replaced or cleared. The billing-intent and aso_active_workspace durations are stated above. Authentication cookies remain for the applicable session and refresh period.
Related server-side retention is addressed separately in the Privacy policy.
8. Third-party services
When a user follows a link to, signs in through, or otherwise interacts with a third-party service, that provider may set its own cookies under its own domain and policies. Spek does not control storage placed by Apple, Google, Stripe, Supabase, or another provider on the provider's own website.
9. Consent
Spek uses essential cookies to provide authentication, requested subscription checkout, workspace, and security functionality, and uses local storage for settings or features requested by the user. Where applicable law requires consent for a technology, Spek obtains it before activation.
10. Your controls
Most browsers allow users to inspect, delete, or block cookies and local storage for a site. Users can also sign out of Spek and clear site data through their browser settings. The exact controls depend on the browser and device.
Blocking or deleting essential storage may prevent sign-in, interrupt a requested checkout, lose the selected workspace, or reset theme, workflow, and rule preferences. Controls for storage on a third-party domain must be exercised with that provider or through the browser.
11. Contact
Questions about this Cookie policy may be sent to RELOAD TECHNOLOGIES - FZCO, Dubai, United Arab Emirates, at hello@spek.app. You can also use our contact page.
We may update this policy when browser storage, the Service, or legal requirements change. We will provide any additional notice or choice required by applicable law.
12. Common questions
How can I describe a browser-storage problem to support?
Describe the browser and device, the page or action involved, and what happened after you signed in, changed a preference or returned from checkout. Mention whether you recently cleared site data or changed cookie settings. You can report the visible message without copying cookie values, authentication tokens or private key contents. The name of a setting is usually more useful than its secret value. Explain whether the problem occurs only in one browser so the team can distinguish local behavior from the workspace's server-side state. Do not assume that resetting all site data is necessary before the issue has been understood.
What should I consider when using a shared computer?
Use the appropriate account for your workspace, keep credentials out of ordinary browser notes or shared messages, and sign out when your work is complete. Browser storage and external provider sessions have their own controls, so leaving a page or closing one tab should not be treated as a universal sign-out from every service you visited. Review the browser's site-data options when you intend to remove local information. Clearing that information can reset preferences and interrupt sessions, but it does not replace workspace membership management, provider-key revocation or the account and data processes described in the other policies.
Where can I see which storage is necessary for a task?
The sections above identify the purposes of authentication storage, the temporary billing-intent cookie, the active-workspace cookie and local preferences. Read the section that matches the action you are investigating rather than treating every stored value as interchangeable. The browser can show site storage, while Spek's policy supplies the product context for its use. Exact browser controls can differ by device and version. If the observed behavior appears inconsistent with this description, contact the team with the task and browser context, keeping secret values out of the report so the discrepancy can be checked without exposing account access.
What is the difference between clearing browser data and deleting my account?
Clearing site cookies or local storage removes information held by that browser. It can end a session or reset a local preference, but it does not itself delete the account, workspace or server-side records described in the Privacy policy. Account and data requests follow their own product and policy processes. If your goal is simply to troubleshoot a browser issue, first note which workspace and task you were using so you can return to the right context after signing in again.
Why might signing in stop working when cookies are blocked?
Authentication storage helps the service maintain a session and complete supported sign-in callbacks. Blocking or removing that essential storage can interrupt the requested flow, even when the account itself remains valid. Review the browser's settings for this site and the behavior described in this policy. A sign-in problem does not require sending a password or private key to support. Describe the browser, the step that failed and the visible message while keeping authentication secrets out of the report.
Does the workspace cookie grant access to an account?
The active-workspace cookie remembers which workspace an authenticated user selected. It does not contain a store private key and it does not replace the membership checks required to use that workspace. This is why remembering a workspace and having permission to operate in it are different concepts. If you belong to more than one team, check the selected workspace before editing drafts or reviewing billing. Clearing browser data can lose the selection without deleting the workspace itself.
Does the checkout cookie contain my payment-card details?
The billing-intent cookie described in this policy carries temporary checkout context rather than a card number or payment secret. Payment-card entry happens in the supported Stripe-hosted flow. Deleting or blocking the cookie can interrupt a checkout that you requested, but it should not be used as evidence that a charge succeeded, failed or was canceled. Check the actual payment and workspace billing state for that outcome, and keep full card details and authentication information out of support messages.
Why can a browser preference differ between devices?
Local storage belongs to the browser and device that holds it. A preference stored there should not be assumed to update every other browser you use. The policy distinguishes browser storage from account and server-side data for this reason. Use the relevant preference controls on the device you are using and review the browser's own site-data controls if you want to remove local values. A change to local settings does not independently revoke a connected store credential or alter a workspace subscription.
Who controls cookies when I follow a link to another service?
The destination provider controls storage under its own domain according to its policies and controls. A link from Spek to a store console, payment provider or another service does not make that provider's browser storage part of Spek's own settings. Review the destination's policy and the browser controls for that site when managing it. This policy explains Spek's use of browser storage; the Privacy policy and the relevant provider documentation supply the separate context for personal-data handling and third-party services.