Version: 2026-08-30.
Provider: AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920.
Last updated: 30 August 2026
1. Who operates this site
This cookie policy applies to https://atly.work (“Atly”, “we”, “us”), operated by AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920.
Contact: admin@atly.work · +420 736 354 123 (mobile) · +420 233 113 271 (landline).
2. What this policy covers
A cookie is a small text file stored on your device when you use the site. This page lists the cookies Atly sets on atly.work (first-party), and briefly notes cookies that third parties may set on their own domains when you use their services through Atly.
Atly does not show a cookie consent banner and does not offer a “Cookie settings” page. The product does not set analytics cookies, advertising cookies, or a cookie that records cookie consent. You can block or delete cookies in your browser; some features then stop working.
3. Cookies Atly sets (first-party)
Unless noted, these cookies are set for Path `/`, SameSite=Lax, and Secure when the site is served over HTTPS. Names with a `__Secure-` or `__Host-` prefix appear on HTTPS; the non-prefixed name is used on plain HTTP (local development).
3.1 Essential — sign-in and security (Auth.js)
| Cookie name | Purpose | Lifetime | | --- | --- | --- | | `__Secure-authjs.session-token` or `authjs.session-token` | Keeps you signed in (encrypted JWT session). | 30 days | | `__Host-authjs.csrf-token` or `authjs.csrf-token` | Protects Auth.js form/API flows against cross-site request forgery. | Browser session | | `__Secure-authjs.callback-url` or `authjs.callback-url` | Remembers where to return after sign-in. | Browser session | | `__Secure-authjs.pkce.code_verifier` or `authjs.pkce.code_verifier` | OAuth PKCE verifier during Google / Microsoft sign-in. | 15 minutes | | `__Secure-authjs.state` or `authjs.state` | OAuth state during Google / Microsoft sign-in. | 15 minutes |
3.2 Essential — product flows
| Cookie name | Purpose | Lifetime | | --- | --- | --- | | `atly_continue` | After a Demo or Trial ends, unlocks the `/continue` convert page for that visitor. | 48 hours | | `atly_invite` | Stores a team invite token from the invite link until registration or join completes. | 48 hours | | `atly_oauth_pkce` | PKCE verifier while connecting mail/calendar (or similar) integrations via OAuth. | 15 minutes | | `atly_acq` | First-party essential cookie. Stores source, medium, and campaign from the link you followed (our own sites or a campaign link) so AtlyTech can see which page a registration, OAuth join, or Demo start came from. Those values are then kept on the account. Not an advertising or analytics vendor cookie; no extra consent banner. | 30 days |
3.3 Preferences (first-party)
| Cookie name | Purpose | Lifetime | | --- | --- | --- | | `locale` | Remembers the UI language you chose (HttpOnly). Without it, Atly uses `Accept-Language` and the signed-in profile locale. | 1 year | | `atly_vp_band` | Remembers list / viewport density band for table layouts. | 1 year |
4. Third parties (not set by Atly as named session cookies)
- Stripe Checkout. When you pay on Stripe’s hosted Checkout, Stripe may set cookies such as `__stripe_mid` and `__stripe_sid` on Stripe’s domain. Atly does not set those names on atly.work as its own session, preferences, or consent cookies.
- Cloudflare Turnstile. Bot checks on unauthenticated forms run in Cloudflare’s widget. Challenge state lives in Cloudflare’s frame context (`challenges.cloudflare.com`), not as an Atly-named cookie on atly.work. atly.work is published through Cloudflare. Cloudflare may set its own security cookies on that hostname.
- Google / Microsoft sign-in. During OAuth you leave Atly briefly; those providers may set cookies on their own domains under their policies.
Atly does not use third-party advertising or analytics cookies on atly.work.
5. How to control cookies
Use your browser settings to block, delete, or limit cookies (for example Chrome Settings → Privacy and security → Cookies; Firefox Settings → Privacy & Security; Safari Settings → Privacy; Edge Settings → Cookies and site permissions). Blocking essential cookies prevents sign-in and related flows.
6. Changes and contact
We update this page when the cookies the product sets change. Questions: admin@atly.work.