Cookie Policy

Last updated: 2026-08-05

A cookie is a small value a site asks your browser to keep and send back on the next request. This policy lists every cookie https://lustai.chat sets, and — because a reader looking for "cookies" means everything a site leaves on their device — the localStorage and sessionStorage keys, the cached audio and the service worker as well. Most of it is what the service runs on and is set without asking, because without it there is no service. Two things are optional and are yours to switch off: measuring how the site is used, and recording which advert brought you here. Both start on, the banner says so on your first visit, and refusing removes them — the analytics script is taken off the page and its cookies deleted, the advertising identifier is deleted here and on our servers. Your answer is remembered for six months and can be changed at any time in Settings.

Cookies we set

These are all of them. The first two are set for you without any choice on your part, because the service does not work without them. The last two are Google's; they appear unless you refuse analytics, and are deleted if you do.

Cookie	Purpose	Lifetime	Category
guest_id	Identifies your anonymous session. It is what keeps the conversations, relationship progress and gems you build up before registering attached to the same account on your next visit. Set by our server, marked HttpOnly (no script in your browser can read it) and sent only over HTTPS.	1 year from when it was last set	Strictly necessary
age_confirmed	Records that you confirmed you are of age, and which edition of these documents you confirmed against. Its value is that edition — a date — not a yes/no flag. Readable by JavaScript by design: the page has to know whether to show the age gate before it renders anything, and a round trip to the API would make the gate flash on every first paint.	1 year from when it was last set	Strictly necessary
lustai_locale	Remembers the interface language you picked. Written only if you pick one, and it holds nothing but a language tag.	1 year	Functional — set only by your own choice
lustai_consent	Your answer to the cookie banner: which optional categories you allowed, and when. Its whole value is a version, the letters of the categories you accepted, and a timestamp — for example v1.a.1755264000, which is analytics accepted and advertising measurement refused. It identifies nothing and nobody; it exists so we do not ask again, and so we can show what was agreed to. It is written whichever way you answer, including when you refuse everything.	6 months from your answer	Strictly necessary — it is the record of your own choice
_ga	Google Analytics: a random identifier for this browser, so repeat visits are counted as one visitor rather than several. Set by Google's script on this domain unless you have refused analytics, and deleted from this browser the moment you do.	2 years	Analytics — optional, on unless you refuse
_ga_XXXXXXXXXX	Google Analytics: the state of the current visit for one specific property. Same condition as above — it disappears with the one above when you refuse.	2 years	Analytics — optional, on unless you refuse

The confirmation stored in age_confirmed is a statement you make about yourself and nothing more. We do not verify it. There is no document check, no photograph, no date of birth collected, no payment-based age check and no third-party age-verification service involved anywhere on this site. The cookie records that the confirmation was given, against which edition, and when it will need to be given again.

Because the cookie's value is an edition, a substantially rewritten set of documents stops matching it, and the confirmation is asked for again on your next visit. The legal pages themselves — this one and its siblings, such as the Terms of Service and the Privacy Policy — stay readable with every cookie blocked, so nobody has to pass a gate to read a document.

Which are necessary, which you choose, and how to change your mind

guest_id and age_confirmed are strictly necessary. Without the first there is no anonymous session, so there is no service to use before you register; without the second the age gate cannot remember an answer and has to block the site on every page load. Consent is not required for strictly necessary cookies and we do not ask for it — refusing them is refusing the service, which you can do by not using it. lustai_consent is in the same category for a different reason: it is the record of your own answer, and without it we would have to ask you again on every visit.

lustai_locale is written only in response to your own action — choosing a language — and carries only the language tag. Nothing in it identifies you, and it is never set if you leave the language alone.

Two categories are optional. Both are on when you arrive, the banner tells you so on your first visit, and either can be switched off there or in Settings at any time afterwards:

Analytics: Google Analytics, which tells us which parts of the site are used and where people give up. Google's script is loaded when the page opens and sets the _ga cookies listed above; it receives the pages you open, the actions you take here and the technical details every request carries. It never receives your messages, your prompts, or the images, video and voice generated for you. Refuse it and three things happen at once: the script element is removed from the page, Google's own opt-out flag is set so the copy already running sends nothing further, and the _ga cookies are deleted from this browser. On your next visit it is not loaded at all.
Advertising measurement: If you arrived by clicking an advert, the advertising network gave that click an identifier and put it in the address of the page you landed on. It is stored in lustai.attribution and sent to us, so that when you register or subscribe we can tell the network its advert worked and it can be paid. That is the entire purpose. The identifier describes nothing about you, is not used to build a profile, is not used to decide which adverts you are shown, and is not shared with anyone other than the network that issued it. Refuse it and it is deleted from this browser and from our records, and no further advert of any network is ever reported as having worked on you.

The banner offers keeping everything and keeping nothing as the same size of button, one tap apart, and a third route to switch the two categories on and off individually. Refusing costs you nothing: every feature of this service works identically either way, and nothing on this site is behind a consent wall.

You can change your answer at any time, from Settings, where the current state of both categories is shown. Switching one off takes effect immediately and deletes what it had stored, as described above. What it cannot do is reach back: page views already counted and a conversion already reported to an advertising network cannot be recalled, which is the honest limit of any switch of this kind.

We do not act on Do Not Track, which browsers send whether or not the person meant anything by it. We do act on Global Privacy Control: if your browser sends that signal and you have not answered the banner yourself, both optional categories are treated as refused before anything optional loads, and the banner is not shown at all. That is the one case in which nothing optional ever starts. An answer you give explicitly always wins over the signal, in both directions.

Other storage the app uses

Most of what this app keeps on your device is not a cookie. It is localStorage and sessionStorage, which the app reads with its own code when it needs a value rather than having the browser attach it to every request. localStorage survives until you clear it; sessionStorage is discarded when you close the tab.

Key	Store	What it holds
lustai.access_token	localStorage	Your session token. It is what keeps you signed in across page loads, and the app attaches it to the requests it makes on your behalf.
lustai.guest_token	localStorage	The token proving this browser owns a particular anonymous account. The counterpart of the guest_id cookie, and the only anchor left when that cookie cannot be used.
lustai.device_id	localStorage	A random identifier this browser generated for itself on first use, kept so the app can tell one browser from another locally. The web client does not send it when it starts an anonymous session — that is done with the guest token above. It is not derived from your hardware and describes nothing about you or your device.
lustai.auth_kind	localStorage	Whether the stored token belongs to an anonymous guest or a registered account, so the right interface is shown on the first paint instead of after a request.
lustai.guest_identity	localStorage	Which account id the guest token was issued for, and when. Used for one thing: noticing that an anonymous session was lost, so the app can say so instead of quietly starting a new one.
lustai.voiced_messages	localStorage	An index of the messages you have already had read aloud on this device, with each clip's length and waveform. The audio itself is in Cache Storage; see the next section.
lustai.seen_stories	localStorage	How far through each character's stories you have watched on this device. There is no server-side equivalent, so it is per-device by necessity.
lustai.nav_collapsed	localStorage	Whether you collapsed the navigation rail. Written only if you collapse it.
lustai.chat_aside_collapsed	localStorage	Whether you collapsed the character panel in a chat. Written only if you collapse it.
lustai.pendingOrder	sessionStorage	The id of the purchase you just started, so that when the payment page sends you back we know which order to check. Discarded once the outcome is known, and in any case when the tab closes.
lustai.boost_seen	sessionStorage	Which progress animations have already played in this tab, so a reload does not replay them.
lustai.boost_slow_runs	sessionStorage	How many animations ran below the frame rate in this tab, so the interface can simplify itself on a device that is struggling.
lustai.attribution	localStorage and sessionStorage	Only if you arrived from an advert: the identifier of the click that brought you here, the campaign labels that came with it in the address, and when it happened. Written on arrival unless you have refused advertising measurement, kept for 30 days, and deleted from both — and from our servers — the moment you refuse. The second copy exists because some browsers refuse to write the first one at all, and without it the identifier would be lost the moment you were sent to the payment page.

Everything in this table is visible in your browser's developer tools, under Application or Storage, and can be deleted key by key from there. One further key, lustai.admin_token, is written only by our own internal administration screen and never on a visitor's device.

Cached audio and the service worker

Two further items live in Cache Storage, which is the browser store for whole files rather than short values.

lustai-voice-v1 (Cache Storage): The audio of messages you have had read aloud. Our server does not keep that audio, and producing it again spends your voice allowance again, so the clip is kept here to make a replay free. Capped at 60 clips; the least recently played is dropped to make room.
lustai-shell-v1 (Cache Storage): Copies of our own pages, stylesheets, scripts and icons, so the site still opens on a bad connection. It holds static files of ours only. It never stores API responses, message text, prompts or generated media.
Service worker (/sw.js): A small script the browser keeps registered for this site. It fills the shell cache, serves it when the network fails, and makes the site installable. It only ever handles same-origin GET requests — it does not see or cache anything from another domain — and it is registered on the live site only.

Both caches, and the registration itself, are removed by "clear site data" for this site, and the service worker can be unregistered on its own from the Application panel of your browser's developer tools.

Storage set by someone else

One other company's script runs on these pages unless you refuse it. Everything else below is a moment where another company's storage is involved because of something you chose to do.

Google Analytics: Google's gtag.js is loaded from googletagmanager.com when the page opens, and sets the _ga cookies described above. Google acts as our processor for it and receives the pages you open and the actions you take here, together with the technical details every request carries — never your messages, your prompts or the media generated for you. Refuse the analytics category and the script is removed from the page, Google's own opt-out flag is set so nothing more is sent, and on the next page load it is not fetched at all. There is no advertising pixel, no remarketing tag and no social-media widget on this site; the analytics property is not linked to any advertising account.
The advertising network that brought you here: If you arrived from an advert, the network that showed it learns — from our server, not from your browser — that the click it identified led to a registration or a purchase. It sets nothing in your browser through these pages, and receives no information about what you do here beyond that one fact. Refuse advertising measurement and it is told nothing at all.
Paying for something: Buying a subscription or a pack of gems sends you to a checkout page hosted by our payment provider, on the provider's own domain. Whatever that page stores is stored by the provider under its own policy, not ours. Card details are entered there, never on this site, and they never reach our servers or any of the storage listed above. What we get back is an order identifier. See the Refund & Cancellation Policy.
Signing in with Google: A sign-in screen that offers Google Sign-In loads Google's script from Google, and Google may read and set its own cookies on its own domains as part of that. That processing is Google's and is governed by Google's policies. Registering with an email address instead avoids it entirely.

Which third parties process data on our behalf, and on what basis, is a separate question from browser storage and is answered in the Privacy Policy.

How to see, delete or block it

Every browser lets you inspect and delete what a site has stored, and lets you block it in advance. The fastest complete route is the per-site "clear site data" action: it removes the cookies, localStorage, sessionStorage and Cache Storage for this site and unregisters the service worker, all at once.

In Chrome, Edge and other Chromium browsers: Settings, then Privacy and security, then Cookies and site data, where a per-site entry lets you delete everything this site stored or block its cookies outright.
In Firefox: Settings, then Privacy & Security, then Cookies and Site Data, and Manage Data for a single site.
In Safari on a computer: Settings or Preferences, then Privacy, then Manage Website Data. On iOS: Settings, then Safari, then Advanced, then Website Data.
In any browser: the padlock or site-information button in the address bar usually offers cookies and site data for the site you are on, which clears this site without touching others.
A private or incognito window keeps all of it only until you close the window.

Blocking cookies for this site is possible from the same screens, and blocking JavaScript storage is possible in some browsers. The legal pages stay readable either way — this document and its siblings need none of it. The service itself does not survive being blocked, and the next section is what breaks, item by item.

What stops working if you clear or block it

Item by item:

guest_id blocked: every visit starts a new anonymous account. Nothing from a previous visit is visible, and nothing you do in this one carries over.
age_confirmed deleted: the age gate asks once more and then remembers again. If you are signed in, the confirmation held on your account also restores the cookie. Blocked outright, the answer cannot be remembered at all and the gate asks on every single visit.
lustai.access_token deleted: you are signed out and need to sign in again. A registered account itself is untouched.
lustai.voiced_messages or the voice cache cleared: messages you had read aloud go back to being plain text, and having them read again spends your voice allowance again. This is the one item on this page where clearing storage costs money.
lustai_locale deleted: the interface falls back to the language your browser asks for, until you choose again.
The preference and progress keys — lustai.nav_collapsed, lustai.chat_aside_collapsed, lustai.seen_stories, lustai.boost_seen — cleared: panels reopen expanded and story rings look unwatched. Nothing else.
The service worker unregistered: the site needs the network to open, and cannot be installed as an app. Nothing else changes.
lustai_consent deleted: the banner asks once more. Nothing optional is stored in the meantime, so the only cost is being asked again.
The optional categories refused: nothing at all changes for you. No feature depends on them. What is lost is on our side — we cannot see which parts of the site are used, and an advertising network we owe money to cannot be told its advert worked.

If you are registered, everything that matters is on the server: sign in again and your conversations, your subscription and your gem balance are all where you left them. What we hold on our side, how long we keep it, and how to ask for a copy or a deletion is in the Privacy Policy.

Changes to this policy

When this policy changes, the "Last updated" date at the top of the page changes with it, and that date is the current edition. New cookies and new storage keys are added to the tables above before they are set. A new optional purpose — anything beyond the two categories described here — is not covered by an answer you gave to a different question: the banner comes back so the new one can be refused on its own terms.

We do not email you when these documents change, and there is no notification list to join. The one signal inside the product is the age gate: a substantially rewritten edition no longer matches the edition stored in age_confirmed, so you are asked to confirm again on your next visit. Checking this page is the reliable way to see what changed.

Who to contact

The cookies and storage described here are set by the operator of this site:

Operator: [LEGAL ENTITY NAME]
Registered address: [REGISTERED ADDRESS]
Registration number: [COMPANY REGISTRATION NUMBER]
Questions about this policy: [email protected]
A lost session, or a purchase you cannot find: [email protected] — first reply within 48 hours.

If gems you paid for are attached to an anonymous session that has been cleared, write to support with whatever payment record you have before doing anything else. We cannot promise the account can be traced, but that is the only route there is, and it is the right one to try before a chargeback — the Refund & Cancellation Policy explains why.