Cookie Policy
Last updated:
How Tax Lens AI uses cookies, local browser storage, and analytics, and the controls currently available to you.
1. What this policy covers
This policy describes the practices verified in the current taxlensai.com implementation and a fresh, logged-out browser check on October 22, 2026. The check covered the homepage, Contact page, loaded analytics script, and the tracker's existing opt-out behavior. Optional account-cookie and grant-storage details below were verified in the application code; no account was signed in and no form was submitted during the browser check.
Cookies are small browser entries sent with matching requests. Local storage is different: it persists on a site origin in your browser and is accessed by scripts, rather than automatically sent as a cookie. Closing a browser tab does not necessarily remove either persistent cookies or local storage. Cookie and browser-storage lifetimes are not the same as retention periods for data held on a provider's servers.
No cookies were observed during the fresh homepage and Contact-page checks. That does not mean the entire website is cookie-free: the conditional authentication cookie and local-storage entries described below still apply. This policy does not make a legal-compliance or cookie-consent exemption claim.
2. Conditional authentication cookie
app_session_id
- Purpose and trigger
- Maintains an authenticated application session after the existing Manus OAuth sign-in callback succeeds. It is not set merely by reading a public page, and this policy is available without signing in.
- Provider and scope
- A first-party cookie issued by the Tax Lens server as part of its Manus authentication integration. The code sets Path=/ and no Domain attribute, making it host-only by default.
- Duration
- The configured cookie lifetime and signed-session lifetime are up to 365 days from successful sign-in. This is a persistent authentication cookie, not a cookie that is automatically removed when a tab closes. The application's account logout procedure clears it; browser cookie deletion can also remove it.
- Configured attributes
- HttpOnly and SameSite=None. Secure is enabled when the server recognizes HTTPS, including a forwarded HTTPS connection. These are implementation details, not a claim that every possible deployment or sign-in flow has been independently audited.
3. Local browser storage
The following entries are local storage, not cookies. They are first-party browser entries on the origin you visit, even where their contents relate to an external service. Clearing cookies alone may not clear them.
grant_auth_token
- Purpose and trigger
- Remembers the authentication token after an existing-applicant login or an application followed by login. Used to request grant status through the Tax Lens server and grant.jamesscott.tech.
- Duration and removal
- No fixed browser-storage expiry is implemented. Removed on grant sign-out, when a grant-status check reports an unauthorized session, or when you clear site storage. The grant service may reject an expired token before the browser entry is removed; its token lifetime has not been independently verified.
- Provider
- Tax Lens AI; token issued by the external grant service at grant.jamesscott.tech.
grant_auth_user
- Purpose and trigger
- Caches grant-user and application-status information for the grant interface. Written after grant login and updated following successful status checks.
- Duration and removal
- No fixed browser-storage expiry is implemented. Removed with grant_auth_token on grant sign-out, an unauthorized status response, or clearing site storage.
- Provider
- Tax Lens AI, using information returned by grant.jamesscott.tech.
taxlens_popup_shown
- Purpose and trigger
- Stores a timestamp when you dismiss the lead-capture popup or successfully submit it, so the popup is not repeatedly displayed.
- Duration and removal
- The timestamp suppresses the popup for 7 days. After 7 days the application ignores the old timestamp; it does not automatically delete that storage entry. It remains until overwritten or you clear site storage.
- Provider
- Tax Lens AI.
manus-runtime-user-info
- Purpose and trigger
- Stores the current application authentication-query result on the homepage, including an empty result for a logged-out visitor. This is a browser-side user-state cache, not the authentication cookie.
- Duration and removal
- No fixed expiry or explicit removal is implemented for this entry. It is overwritten when the homepage authentication-query state changes and can be removed by clearing site storage.
- Provider
- Tax Lens AI's application runtime, integrated with Manus authentication.
umami.disabled
- Purpose and trigger
- An optional analytics opt-out flag that you can create using the browser instructions below. The installed analytics script checks it before sending events; it is not automatically created on an ordinary visit.
- Duration and removal
- No automatic expiry. Applies to the current site origin and browser profile until you remove the flag or clear site storage.
- Provider
- Read by the Umami tracker served from manus-analytics.com.
4. Analytics and other providers
The site loads an Umami analytics tracker from manus-analytics.com/umami. Its purpose is to measure website visits and navigation. The inspected script does not write analytics cookies and sends requests to manus-analytics.com/api/send with browser credentials omitted. The fresh browser check confirmed analytics requests without analytics cookies.
The inspected tracker prepares the page URL, page title, referrer, hostname, browser language, and screen dimensions for its requests. Its URL handling can include query strings and fragments; the current script tag does not enable their exclusion. Cookie-free analytics still sends information to a server, and the server receives normal network-request information. The hosting provider's server-side retention period and processing settings were not verified, so no fixed analytics-data retention period or guarantee of full anonymity is stated here.
- CAP.js and form protection: the widget is delivered through jsDelivr at cdn.jsdelivr.net, and its configured verification endpoint is captcha.jamesscott.tech. Ordinary form submissions use cbackend.jamesscott.tech. The application holds the verification token in page memory; it does not create a persistent CAPTCHA cookie in the reviewed form code. The browser check did not include solving or submitting a challenge, and these services' server retention was not verified.
- Fonts and assets: Google Fonts resources are requested from fonts.googleapis.com and fonts.gstatic.com, and site assets may load from files.manuscdn.com. These providers receive requests when their resources load. No cookies from these resources were observed in the limited browser check; their broader practices and server retention were not independently verified.
- Grant and external resources: grant.jamesscott.tech is contacted through the Tax Lens server for grant features. Blog media and linked documents or presentations may use other hosts. Cookies on external websites after you open a link, including authentication-provider pages, are outside this site's first-party inventory and are governed by those providers' own controls and policies.
5. Your controls
Use your browser's privacy or site-data settings to inspect, block, or delete cookies and local storage. Available controls vary by browser. Blocking or deleting authentication data can end a session or prevent account features from remembering you. Clearing the popup marker can allow the popup to appear again. Grant sign-out removes both grant-storage entries; it is separate from the application account logout that clears app_session_id.
The installed analytics tracker supports an existing browser-local opt-out. Advanced users can open their browser's developer console while on this site and enter:
localStorage.setItem("umami.disabled", "1");Reload the page after setting the flag. The flag prevents this tracker from sending subsequent analytics events in that site origin and browser profile; it does not delete previously collected server data or block unrelated providers. To re-enable this tracker, remove the flag and reload:
localStorage.removeItem("umami.disabled");This behavior was tested in an isolated browser profile: analytics requests stopped with the flag and resumed after its removal. You must apply the choice separately in another browser profile or site origin. Clearing local storage also clears this opt-out and can allow analytics to resume. See the provider's Umami opt-out instructions for reference.
The current implementation has no dedicated cookie-consent banner or preference dashboard. The analytics script starts automatically unless its opt-out or other blocking conditions apply. The script tag does not enable Umami's Do Not Track option, and no Global Privacy Control handling was identified in the inspected tracker. Do not assume those browser signals alone disable this installation. Publishing this policy does not change the existing analytics or storage behavior.
6. Questions and updates
For questions about cookies or browser storage, use our existing Contact page. Please identify the page and browser entry involved without sending session tokens, passwords, or confidential client data. For broader information about personal-data practices, see the existing Privacy Policy.
This inventory reflects the review date above. Cookie and storage behavior can change when services or browser settings change. We will update this policy when the verified implementation changes; external-provider lifetimes and data-processing details should not be inferred from the first-party durations listed here.