Cookies
The cookies and browser storage Oat uses, who sets them, what they do and how long they last.
Last updated 30 September 2026
In short
- Clerk and Oat set cookies that keep you signed in and protect account connections. They are necessary.
- PostHog sets one cookie for product analytics and session recordings. It is not used for ads.
- A few preferences and unsaved edits stay in your browser only.
- No advertising cookies. Websites hosted on Oat set no analytics cookies.
Oat is a product of Airmeet Inc. AI Labs. It is provided by Airmeet Inc., a Delaware corporation.
1. Strictly necessary cookies
These keep you signed in and keep account connections safe. Oat cannot work without them, so they are set without asking.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| Names beginning __session, __client_uat, __client and __clerk | Clerk, our sign-in provider | Keeps you signed in and lets the server check who is making each request | Your session; refreshed while you use Oat |
| oat_last_workspace | Oat | Opens the workspace you used last | 90 days |
| oat_wa_login | Oat | Ties a WhatsApp sign-in to the browser that started it | 15 minutes |
| oat_social_<id>, oat_oauth_<provider>, oat_analytics_oauth, oat_wispr_oauth | Oat | Holds a one-time secret while you connect a social account, Google, Wispr Flow or another service, so a replayed or cross-workspace callback is rejected | 15 minutes, or until the connection completes |
Oat's own cookies are httpOnly (scripts on the page cannot read them) and sent only over HTTPS in production.
2. Analytics cookies and storage (PostHog)
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| ph_<project key>_posthog (a cookie and the same key in local storage) | PostHog, for Oat, through withoat.com/ox | Tells visits and sessions apart for product analytics, error tracking and session recordings on Oat's own pages, and links events to your account when you are signed in. Never used for advertising | 1 year |
PostHog runs for analytics and session recordings whenever you use withoat.com or the app; there is no separate consent prompt for it. It is not used for advertising, and it is not set on websites or newsletter pages creators host on Oat. Recordings are kept for 30 days. The privacy notice says what it records and what it masks. You can block it by blocking cookies and site data for withoat.com or with a tracker-blocking extension; Oat keeps working.
3. Preferences and unsaved work in your browser
Oat keeps a few small items in your browser's local or session storage. They never leave your device.
| Key | Purpose | Lasts |
|---|---|---|
| oat-edit:<piece>:<revision> | Keeps an edit you have not saved yet, so a refresh does not lose it | Until you save or discard it |
| oat:last-studio:… | Reopens the Studio chat you were last in | This tab only |
| oat:studio-rail-collapsed | Remembers whether the Studio chats panel is hidden | Until you clear site data |
| oat-activation-hidden:<workspace> | Remembers that you hid the Getting started panel | Until you clear site data |
| oat-wa-bar-hidden-until | Remembers that you hid the Connect WhatsApp bar | One week |
| oat-screen-usage | Counts which screens you visit so Oat can warm the likely next one | Until you clear site data |
4. What we do not use
No advertising pixels, no marketing or retargeting cookies, no social-media tracking embeds and no browser fingerprinting. Websites hosted on Oat count visits without cookies, using a daily hash that cannot follow a visitor across days or sites. If this changes, this page changes first.
5. Services you connect
When you sign in to Google, Meta, LinkedIn, X, Wispr Flow or another provider to connect it, that provider sets its own cookies on its own domain. Its cookie policy applies to those, not this one.
6. Your choices
Your browser lets you see and delete cookies and site data at any time. Deleting Clerk's cookies signs you out, and blocking them stops Oat from working, because it cannot tell who you are. Blocking PostHog does not affect Oat. Questions go to support@airmeet.com; the privacy notice covers everything else we collect.