Cookies and local storage.

Pilo uses localStorage for this website’s origin with the key solutai_pilo_state. It stores muted (true or false: mute setting), proactivity (normal or quiet: suggestion level) and updatedAt (the date and time of the change in ISO format). It writes this preference when you change these settings or resume Pilo, to remember them across pages and visits; it stores no identity, visitor identifiers or conversations. updatedAt records a preference change, not browsing activity.

There is no automatic expiry: it remains until you delete it; changing the preference replaces its value. If your browser blocks storage, it works only in memory. Reduced motion comes from your browser setting and is not stored in this key.

Pilo stores an HMAC-SHA256 signed session token, its expiry and the Worker endpoint (token, expiresAt, endpoint) in sessionStorage under solutai_pilo_session. The token contains the origin and a random session ID, without an IP address or conversation. It lasts 30 minutes without activity, renewed with each authenticated request, up to an absolute maximum of 2 hours after verification. It is discarded when read after expiry, when the tab closes, when you let Pilo rest or reset its preferences. It is never stored in localStorage; if storage is blocked, it remains only in memory until reload.

In your browser, history lives only in memory: up to six messages (three exchanges), with a total limit of 1,800 characters. It is cleared when you leave or reload the page, let Pilo rest, or the local filter detects personal data. Pilo stores no conversations, drafts or audio in Web Storage and creates no cookies of its own. Only the session credential described in this policy is stored in sessionStorage.

Opening the text input to write to Pilo, using its controls or Alt+P, downloads Cloudflare Turnstile from challenges.cloudflare.com only when no valid conversation session exists. This happens before sending a message; reading, seeing the greeting or scrolling does not load it. With a valid session, no script is downloaded and no widget is created. The separate contact form loads Turnstile when you select “Send enquiry”. Cloudflare processes technical browser and connection data, including IP addresses, to prevent abuse.

Pilo’s first request verifies a single-use Turnstile token without adding remoteip and receives a signed session; subsequent requests validate that session without another challenge until expiry. If the server rejects the session, it is cleared and the same message is retried once with a new Turnstile challenge. Contact verifies a single-use token on each submission, with hostname solutai.com and action contact. Widgets are removed when the challenge ends. Both have pre-clearance disabled (no_clearance) and do not issue cf_clearance through that feature; Cloudflare zone protections may set security cookies separately.

Security cookie names and expiry depend on the protections triggered and the cookie actually received. You can inspect the domain and expiry in your browser’s site data. We do not attribute every Cloudflare cookie to this widget or claim that Cloudflare never uses cookies.

In Pilo’s menu, choose “Fewer suggestions” or “Let Pilo rest”. Letting Pilo rest clears the in-memory history and saves the mute setting. “Reset Pilo preferences” deletes the solutai_pilo_state key; you can also delete it by clearing solutai.com site data and local storage in your browser settings.

You can read the website and email the team without conversing with Pilo. Blocking or clearing browser data may affect preferences or security verification. Local deletion does not erase content already processed by providers; the privacy policy explains Cloudflare Workers, DeepSeek, the international transfer to China, legal bases and your rights under GDPR and Colombian Law 1581 of 2012.